CloudNativeSecurityCon North America 2024

All cloud platforms offer audit logs of their cloud control planes (e.g., AWS CloudTrail, Google Cloud Platform Audit Logs, Azure Activity Logs) but these generate such a high volume of logs that wading through them to find indications of a threat is a huge challenge. In this talk, I’ll explain how you can take this massive stream of data and break it down into manageable chunks using basic cloud building blocks like S3 buckets and SQS queues, or more sophisticated tools like OpenSearch and Kubernetes, to create your own detection platform and build custom analytics to search for whatever needle you want to find in the haystack. This will reduce the flood of data down into a trickle of actionable alerts, in the same way that Red Canary sifts through more than 6 billion cloud log records a day.