#amazondetective #aws #cloudcomputing Cybersecurity is one of the priorities in the age of the information society, where data is a value in itself. It is worth paying attention to properly designed security solutions. Amazon Detective is the latest security service from the AWS family. You can find more in our blog post: https://lcloud.pl/en/security-investigatior-amazon-detective/ Follow us on our social media channels: LCloud Blog https://lcloud.pl/en/blog/ Facebook https://bit.ly/2tCqBJS Twitter https://twitter.com/LCLOUD16 SlideShare https://www.slideshare.net/LCloud LinkedIn https://bit.ly/2syaQCr

1. On a trail with
Amazon Detective
On a trail with
Amazon Detective

2. What is Amazon
Detective?

3. Amazon Detective is the latest security service from the
AWS family. It uses machine learning, statistical
analysis and graph theory, in combination with AWS
resource log data to detect potentially dangerous
activities and security issues. It allows clients to view
summaries and analytical data related to events in AWS
CloudTrail as well as VPC Flow Logs. Amazon Detective
also processes the results obtained from Amazon
GuardDuty, when customer enabled the service.

4. Mechanism behind
the Amazon Detective

5. How it works?
Source: https://aws.amazon.com/detective/

6. How to launch
Amazon
Detective?

7. Select and run Amazon Detective from the AWS
console. Then configure the organization's accounts
for monitoring and the "master" account for data
collection.
Step 1

8. The Amazon Detective service immediately begins
the analysis of telemetry data, creating graphical
visualizations.
Step 2

9. Select from the console the resource type and ID of
interests you and check the detected irregularities on
the chart. You can also use the integration with
Amazon GuardDuty and AWS Security Hub.
Step 3

10. Amazon Detective provides interactive charts along
with detailed data and results context. In addition,
we get such accurate data as location or behavior
patterns on the main account.
Step 4

11. Use cases

12. Triage security
findings
It allows to determine the incident
related IP addresses, resources and AWS
accounts as well as activities at the time
when the event took place and to
determine whether it is really malicious
activity or false alarm.

13. It allows conducting an investigation
process, in-depth analysis of malicious
activity detected by services such as
Amazon GuardDuty, along with
determining its impact and scope on
security.
Incident
investigation

14. This is a proactive analysis, providing
explanations based on time analysis,
which aims to locate hidden threats
based on hypotheses and tips.
Threat
hunting

15. Benefits from
implementation

16. Benefits from Amazon Detective implementation
▪ compliance with industry best practices and standards,
▪ accurate and comprehensive reports indicating threats, security gaps and the exact
location of their occurrence,
▪ automated security solution,
▪ the ability to integrate with security offered by other providers,
▪ simplifying the investigation process and improving the detection of potential threats,
▪ it is time saving.

17. Any questions?
We can help you!
Feel free to contact us
kontakt@lcloud.pl
www.lcloud.pl
Thank you for your time!
All source materials in the presentation have been appropriately marked.