SlideShare une entreprise Scribd logo
1  sur  6
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Shawn Marck, AWS Perimeter Protection
March, 2019
Enhanced Security Analytics
Using WAF Logs & Elastic Search
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Demo Resources
Elasticsearch Tutorial: A Quick Start Guide
https://amzn.to/2KEFTEl
How to Analyze AWS WAF Logs Using Amazon Elasticsearch Service
https://amzn.to/2BAYY7y
Amazon Cognito Authentication for Kibana
https://amzn.to/2Q2YUX5
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Log aggregation and analysis reference architecture
AWS Shield
Dynamic Web
Application
Users
Amazon S3 Bucket
For Static Content
Amazon
CloudFront
Amazon
Route 53
Amazon VPC
AWS WAF
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Log aggregation and analysis reference architecture
AWS Shield
Amazon
Elasticsearch
Service
Amazon
CloudFront
Amazon
Route 53
Amazon VPC
AWS WAF Amazon
Kinesis Data Firehose
Amazon
Cognito
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Demonstration
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Thank you!

Contenu connexe

Tendances

Tendances (20)

AWS Well-Architected Workshop
AWS Well-Architected WorkshopAWS Well-Architected Workshop
AWS Well-Architected Workshop
 
Deploy and Govern at Scale with AWS Control Tower
Deploy and Govern at Scale with AWS Control TowerDeploy and Govern at Scale with AWS Control Tower
Deploy and Govern at Scale with AWS Control Tower
 
Building PaaS with Amazon EKS for the Large-Scale, Highly Regulated Enterpris...
Building PaaS with Amazon EKS for the Large-Scale, Highly Regulated Enterpris...Building PaaS with Amazon EKS for the Large-Scale, Highly Regulated Enterpris...
Building PaaS with Amazon EKS for the Large-Scale, Highly Regulated Enterpris...
 
Optimizing Costs as You Scale on AWS (ENT302) - AWS re:Invent 2018
Optimizing Costs as You Scale on AWS (ENT302) - AWS re:Invent 2018Optimizing Costs as You Scale on AWS (ENT302) - AWS re:Invent 2018
Optimizing Costs as You Scale on AWS (ENT302) - AWS re:Invent 2018
 
AWS Cloud Adoption Framework and Workshops
AWS Cloud Adoption Framework and WorkshopsAWS Cloud Adoption Framework and Workshops
AWS Cloud Adoption Framework and Workshops
 
AWS Control Tower
AWS Control TowerAWS Control Tower
AWS Control Tower
 
Protecting Your Data- AWS Security Tools and Features
Protecting Your Data- AWS Security Tools and FeaturesProtecting Your Data- AWS Security Tools and Features
Protecting Your Data- AWS Security Tools and Features
 
OpsNow를 활용한 AWS Cloud 비용 최적화 전략
OpsNow를 활용한 AWS Cloud 비용 최적화 전략OpsNow를 활용한 AWS Cloud 비용 최적화 전략
OpsNow를 활용한 AWS Cloud 비용 최적화 전략
 
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
 
Cost Optimisation on AWS
Cost Optimisation on AWSCost Optimisation on AWS
Cost Optimisation on AWS
 
AWS CloudWatch
AWS CloudWatchAWS CloudWatch
AWS CloudWatch
 
AWS Landing Zone Deep Dive (ENT350-R2) - AWS re:Invent 2018
AWS Landing Zone Deep Dive (ENT350-R2) - AWS re:Invent 2018AWS Landing Zone Deep Dive (ENT350-R2) - AWS re:Invent 2018
AWS Landing Zone Deep Dive (ENT350-R2) - AWS re:Invent 2018
 
Cost Optimisation on AWS
Cost Optimisation on AWSCost Optimisation on AWS
Cost Optimisation on AWS
 
AWS Initiate Day Dublin 2019 – Cost Optimization on AWS
AWS Initiate Day Dublin 2019 – Cost Optimization on AWSAWS Initiate Day Dublin 2019 – Cost Optimization on AWS
AWS Initiate Day Dublin 2019 – Cost Optimization on AWS
 
Introduction to the Well-Architected Framework and Tool - SVC208 - Anaheim AW...
Introduction to the Well-Architected Framework and Tool - SVC208 - Anaheim AW...Introduction to the Well-Architected Framework and Tool - SVC208 - Anaheim AW...
Introduction to the Well-Architected Framework and Tool - SVC208 - Anaheim AW...
 
AWSome Day Online 2020_Module 1: Introduction to the AWS Cloud
AWSome Day Online 2020_Module 1: Introduction to the AWS CloudAWSome Day Online 2020_Module 1: Introduction to the AWS Cloud
AWSome Day Online 2020_Module 1: Introduction to the AWS Cloud
 
Deep dive into AWS IAM
Deep dive into AWS IAMDeep dive into AWS IAM
Deep dive into AWS IAM
 
Preparing_for_PCA_Workbook.pptx
Preparing_for_PCA_Workbook.pptxPreparing_for_PCA_Workbook.pptx
Preparing_for_PCA_Workbook.pptx
 
AWS Technical Essentials Day
AWS Technical Essentials DayAWS Technical Essentials Day
AWS Technical Essentials Day
 
세션 3: IT 담당자를 위한 Cloud 로의 전환
세션 3: IT 담당자를 위한 Cloud 로의 전환세션 3: IT 담당자를 위한 Cloud 로의 전환
세션 3: IT 담당자를 위한 Cloud 로의 전환
 

Similaire à Enhanced Security Analytics using WAF logs & Elastic Search

Similaire à Enhanced Security Analytics using WAF logs & Elastic Search (20)

Visualise and Voice-Enable Your Security - AWS Summit Sydney 2018
Visualise and Voice-Enable Your Security - AWS Summit Sydney 2018Visualise and Voice-Enable Your Security - AWS Summit Sydney 2018
Visualise and Voice-Enable Your Security - AWS Summit Sydney 2018
 
Build a dashboard using serverless security analytics - SDD201 - AWS re:Infor...
Build a dashboard using serverless security analytics - SDD201 - AWS re:Infor...Build a dashboard using serverless security analytics - SDD201 - AWS re:Infor...
Build a dashboard using serverless security analytics - SDD201 - AWS re:Infor...
 
Visualise and Voice-Enable Your Security
Visualise and Voice-Enable Your SecurityVisualise and Voice-Enable Your Security
Visualise and Voice-Enable Your Security
 
Canberra AWS User Group - March 2019 Intro
Canberra AWS User Group - March 2019 IntroCanberra AWS User Group - March 2019 Intro
Canberra AWS User Group - March 2019 Intro
 
Securing Your Big Data Workload - AWS Summit Sydney 2018
Securing Your Big Data Workload - AWS Summit Sydney 2018Securing Your Big Data Workload - AWS Summit Sydney 2018
Securing Your Big Data Workload - AWS Summit Sydney 2018
 
Lean and clean SecOps using AWS native services cloud - SDD301 - AWS re:Infor...
Lean and clean SecOps using AWS native services cloud - SDD301 - AWS re:Infor...Lean and clean SecOps using AWS native services cloud - SDD301 - AWS re:Infor...
Lean and clean SecOps using AWS native services cloud - SDD301 - AWS re:Infor...
 
【14-C-8】みんなの暮らしを支えるAmazon S3の裏側、お伝えします
【14-C-8】みんなの暮らしを支えるAmazon S3の裏側、お伝えします【14-C-8】みんなの暮らしを支えるAmazon S3の裏側、お伝えします
【14-C-8】みんなの暮らしを支えるAmazon S3の裏側、お伝えします
 
MassMutual Goes Cloud First with Hybrid Cloud on AWS (ENT210) - AWS re:Invent...
MassMutual Goes Cloud First with Hybrid Cloud on AWS (ENT210) - AWS re:Invent...MassMutual Goes Cloud First with Hybrid Cloud on AWS (ENT210) - AWS re:Invent...
MassMutual Goes Cloud First with Hybrid Cloud on AWS (ENT210) - AWS re:Invent...
 
Threat detection and mitigation at AWS - SEC301 - Santa Clara AWS Summit
Threat detection and mitigation at AWS - SEC301 - Santa Clara AWS SummitThreat detection and mitigation at AWS - SEC301 - Santa Clara AWS Summit
Threat detection and mitigation at AWS - SEC301 - Santa Clara AWS Summit
 
AWS Canberra User Group Into - June 2019
AWS Canberra User Group Into - June 2019AWS Canberra User Group Into - June 2019
AWS Canberra User Group Into - June 2019
 
20191127 AWS Black Belt Online Seminar Amazon CloudWatch Container Insights で...
20191127 AWS Black Belt Online Seminar Amazon CloudWatch Container Insights で...20191127 AWS Black Belt Online Seminar Amazon CloudWatch Container Insights で...
20191127 AWS Black Belt Online Seminar Amazon CloudWatch Container Insights で...
 
DEM20 Protecting Your Data in Amazon S3
DEM20 Protecting Your Data in Amazon S3DEM20 Protecting Your Data in Amazon S3
DEM20 Protecting Your Data in Amazon S3
 
AWS Canberra User Group - August 2019 Intro
AWS Canberra User Group - August 2019 IntroAWS Canberra User Group - August 2019 Intro
AWS Canberra User Group - August 2019 Intro
 
Analyzing your web and application logs with Cloudfront and ElasticSearch Ser...
Analyzing your web and application logs with Cloudfront and ElasticSearch Ser...Analyzing your web and application logs with Cloudfront and ElasticSearch Ser...
Analyzing your web and application logs with Cloudfront and ElasticSearch Ser...
 
Bridge the Storage Gap: Hybrid Media Workflows with AWS Storage Gateway (STG3...
Bridge the Storage Gap: Hybrid Media Workflows with AWS Storage Gateway (STG3...Bridge the Storage Gap: Hybrid Media Workflows with AWS Storage Gateway (STG3...
Bridge the Storage Gap: Hybrid Media Workflows with AWS Storage Gateway (STG3...
 
Deep dive on storage offerings: What to use, where, and why - STG303 - New Yo...
Deep dive on storage offerings: What to use, where, and why - STG303 - New Yo...Deep dive on storage offerings: What to use, where, and why - STG303 - New Yo...
Deep dive on storage offerings: What to use, where, and why - STG303 - New Yo...
 
Serverless days Stockholm - How to build a full-stack airline ticketing web app
Serverless days Stockholm - How to build a full-stack airline ticketing web appServerless days Stockholm - How to build a full-stack airline ticketing web app
Serverless days Stockholm - How to build a full-stack airline ticketing web app
 
How to build a FullStack Airline Ticketing Web App.pdf
How to build a FullStack Airline Ticketing Web App.pdfHow to build a FullStack Airline Ticketing Web App.pdf
How to build a FullStack Airline Ticketing Web App.pdf
 
India cloudsummit Bangalore - Advanced Container Use-cases on AWS Container S...
India cloudsummit Bangalore - Advanced Container Use-cases on AWS Container S...India cloudsummit Bangalore - Advanced Container Use-cases on AWS Container S...
India cloudsummit Bangalore - Advanced Container Use-cases on AWS Container S...
 
Canberra AWS User Group Intro - May 2019
Canberra AWS User Group Intro - May 2019Canberra AWS User Group Intro - May 2019
Canberra AWS User Group Intro - May 2019
 

Plus de Amazon Web Services

Tools for building your MVP on AWS
Tools for building your MVP on AWSTools for building your MVP on AWS
Tools for building your MVP on AWS
Amazon Web Services
 
How to Build a Winning Pitch Deck
How to Build a Winning Pitch DeckHow to Build a Winning Pitch Deck
How to Build a Winning Pitch Deck
Amazon Web Services
 
Building a web application without servers
Building a web application without serversBuilding a web application without servers
Building a web application without servers
Amazon Web Services
 
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
Amazon Web Services
 

Plus de Amazon Web Services (20)

Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
 
Esegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS FargateEsegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS Fargate
 
Costruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWSCostruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWS
 
Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot
 
Open banking as a service
Open banking as a serviceOpen banking as a service
Open banking as a service
 
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
 
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
 
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows WorkloadsMicrosoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
 
Computer Vision con AWS
Computer Vision con AWSComputer Vision con AWS
Computer Vision con AWS
 
Database Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatareDatabase Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatare
 
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJSCrea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
 
API moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e webAPI moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e web
 
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatareDatabase Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
 
Tools for building your MVP on AWS
Tools for building your MVP on AWSTools for building your MVP on AWS
Tools for building your MVP on AWS
 
How to Build a Winning Pitch Deck
How to Build a Winning Pitch DeckHow to Build a Winning Pitch Deck
How to Build a Winning Pitch Deck
 
Building a web application without servers
Building a web application without serversBuilding a web application without servers
Building a web application without servers
 
Fundraising Essentials
Fundraising EssentialsFundraising Essentials
Fundraising Essentials
 
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
 
Introduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container ServiceIntroduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container Service
 
Come costruire un'architettura Serverless nel Cloud AWS
Come costruire un'architettura Serverless nel Cloud AWSCome costruire un'architettura Serverless nel Cloud AWS
Come costruire un'architettura Serverless nel Cloud AWS
 

Enhanced Security Analytics using WAF logs & Elastic Search

  • 1. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Shawn Marck, AWS Perimeter Protection March, 2019 Enhanced Security Analytics Using WAF Logs & Elastic Search
  • 2. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Demo Resources Elasticsearch Tutorial: A Quick Start Guide https://amzn.to/2KEFTEl How to Analyze AWS WAF Logs Using Amazon Elasticsearch Service https://amzn.to/2BAYY7y Amazon Cognito Authentication for Kibana https://amzn.to/2Q2YUX5
  • 3. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Log aggregation and analysis reference architecture AWS Shield Dynamic Web Application Users Amazon S3 Bucket For Static Content Amazon CloudFront Amazon Route 53 Amazon VPC AWS WAF
  • 4. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Log aggregation and analysis reference architecture AWS Shield Amazon Elasticsearch Service Amazon CloudFront Amazon Route 53 Amazon VPC AWS WAF Amazon Kinesis Data Firehose Amazon Cognito
  • 5. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Demonstration
  • 6. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Thank you!

Notes de l'éditeur

  1. aws.amazon.com/firewall-manager/pricing