SIEM Integration

This section addresses options and resources to enable your Security team to integrate centrally captured AWS platform log and event information with new or existing enterprise Security Information and Event Management (SIEM) services.

Requirements

Even in this early development stage, your Security and Compliance requirements may dictate that cloud platform access and cloud resource configuration be monitored via your existing enterprise standard Security Information and Event Management (SIEM) solution.

…In the context of the overall set of Security and Compliance requirements, highlight the typical role and value of integrating AWS CloudTrail and other event sources with SIEM services…

…incorporate AWS SecurityHub…

  • AWS API usage (e.g. AWS CloudTrail logs)
  • AWS Resource Configuration changes (e.g. AWS Config)
  • Network traffic monitoring (e.g. partly based on capture of VPC Flow Logs)

Solution Options and Resources

…