Getting Started with Security Analytics

About the Workshop:

Security analytics is an approach to cybersecurity that uses data ingestion, data aggregation and analysis tools for threat detection and security monitoring. An organization that deploys security analytics tools can analyze security events to detect potential threats before they can affect the company's infrastructure, reducing risk.

Security analytics combines big data capabilities with threat intelligence to help detect, analyze and mitigate insider threats, as well as persistent cyber threats and targeted attacks from external bad actors. Log enrichment and data augmentation helps add additional context to security log data which eventually aids in deriving security insights quickly.

The Security Analytics Immersion Day allows hands-on experience with ingesting, transforming and analyzing log files from various AWS security services such as Amazon GuardDuty, Amazon Inspector, AWS Security Hub, and Amazon VPC Flow logs by leveraging AWS analytics services including Amazon Kinesis Services for streaming data ingestion and analytics, Amazon OpenSearch for normalizing and analyzing logs, AWS Glue for data catalog and ETL work, Amazon Athena to query data lake, and Amazon QuickSight for visualization. This Immersion day helps to build a cloud-native security data lake.

At the conclusion of the event, you will have an understanding of various security analytics use cases and AWS security services. It will help security analysts understand various security analytics use cases.

There will be temporary AWS accounts provided for the hands on labs. The purpose of these temporary accounts is to ensure that all resources and permissions are set up correctly and to avoid any charges in your personal or business accounts. If you join late or are not active when the accounts are released, we will not be able to provide the temporary account. You will be able to watch the lab as a demo and complete the lab in your own account at a later time.

You must be registered to be issued a temporary AWS Account. Do not join the event with someone else’s registration link.You will need to use the same email address you registered with to access your temporary AWS account.

This Immersion Day qualifies for the Security Analytics Immersion Day Builder’s Quest participation badge. 

Who Should Attend:

This event is best suited for InfoSec and DevSecOps professionals. Some familiarity with AWS and experience in writing and executing SQL queries is recommended. For the best experience, we recommend the use of two monitors.

Topics Covered:

• Presentation: Security Analytics Overview
• Presentation: Security and Analytics Services Deep Dive
• Lab: Security Analytics Immersion Day