Document toolboxDocument toolbox

AWS Security Monitoring DEMO

Purpose

The Amazon Web Services (AWS) Security Monitoring application is a comprehensive tool primarily focused on security use cases. Here, you can analyze the general status of an AWS environment from an operational standpoint.

Security Monitoring uses a single pane of glass approach, unifying data across several sources into one easy-to-use view. This simplifies the diagnostics of an AWS environment, facilitating the analysis of running instances as well as their performance and health in real-time.

This content is a demostration

The content in this application is for demonstration purposes only. To use this application in your production environment, you will need to configure it to run with your data sources and processes. For further assistance, please contact Devo customer support.

Prerequisites

To use the AWS Security Monitor, you must first meet all access requirements to the associated technologies. Having met these requirements, to access the AWS Security Monitor, you must have the following data sources available in your domain:

Service Operations required

If you don’t have it, it will be automatically installed together with the installation of the first map. Refer to Service Operations to know more about the application.

Open ServiceOps map

Once you have installed the map, you can use the Open button at the top right of the card in Exchange to access Service Operations with the map open, where you can work with it as required. Application-type maps will also have a shortcut in the Applications menu of the Navigation pane as if they were a standalone app.

You can also access Service Operations via the Navigation pane (Applications → Service Operations) and then select the map from the list of available domain or global maps.

 

 

Work with ServiceOps map

Once you open the AWS Security Monitoring you are presented with a summary view of the system overview. This view shows you a summary of all stats to analyze on your map. You can click each of them to have further details (refer to Working with maps to know more about the views).

  1. Audit events by service

2. Counters

3. Statistics

4. Overall security score

  1. Audit events by service

2. Counters

3. Statistics

4. Overall security score

  • Infrastructure

  • Networking

  • Data Storage

  • DevOps

  • Security

  • Instance check fails

  • System check fails

  • Credit balance

  • Credit usage

  • Lambdas

  • S3 buckets

  • ELB Instances

  • EC2 Instances

  • RDS instances

Score based on positive alerts detected.

Â