AWS Cloud TutorialLesson 64Free preview
AWS Detection and Response
This lesson is part of AWS · All levels
Summary
Threat detection continuously monitors suspicious activity, while incident response handles and restores the situation when a breach occurs. Amazon GuardDuty analyzes VPC Flow Logs, CloudTrail, and DNS with machine learning to detect threats. The AWS Security Hub combines security findings from a variety of services into one dashboard.
Key points
- GuardDuty: automatic threat detection from AWS
- Detective helped dig up the roots of the security findings.
- Security Hub: aggregating and evaluating findings to security standards
- Incident response: identification, isolation, eradication, recovery
- CloudWatch alarms trigger notifications when the metric is suspicious
Full lesson
Code examples and quizzes
Full lessons, code examples, and quizzes are available to subscribers. 5 questions.