Hi, guys. In this lesson, we're going to look at a few services we can use from a security perspective
to detect some of the activities that are happening in our account that might be suspicious or malicious
and how we can respond as well.
Firstly, we have Amazon Detective.
This service can help you to analyze, investigate, and identify the root cause of potential security
issues or suspicious activity.
It automatically collects data from your resources and uses machine learning, statistical analysis,
and graph theory.
It will create a unified, interactive view of your resources, and it's mapping the interactions between
them and then using that machine learning to try and work out what's going on and what looks normal
and what doesn't.
The data sources that you can feed into Detective include VPC Flow Logs, CloudTrail API activity,
and also information coming from GuardDuty.
So what is GuardDuty?
This is an intelligence threat detection service.
It detects account compromise, instance compromise, malicious reconnaissance activities,
and bucket compromise as well.
It performs continuous monitoring across a number of services, CloudTrail Management Events,
CloudTrail S3 Data Events, VPC Flow Logs, and DNS Logs as well.
Then we have Amazon Macie.
Macie is a fully managed data security and data privacy service.
What this service does is it actually looks at your data in Amazon S3 and uses machine learning
and pattern matching to identify sensitive data.
It enables compliance and preventive security.
Macie can identify a variety of data types.
This includes personally identifiable information, PII, protected health information, PHI
regulatory documents, API keys, and secret keys.
Now this is where it comes up in the exam.
So you might see a question that relates to finding some kind of sensitive data on Amazon S3
and Macie is likely to be the service that would do that for you.
So let's look visually at how it works.
Macie will automatically discover S3 buckets.
Then it will analyze the buckets using machine learning and looks for sensitive information.
Then the findings can be recorded in CloudWatch Events.
So that, of course, could trigger some kind of event happen to perhaps remediate or notify someone.
So there's a few services that we've just covered there and they're only covered
at light level in the exam.
So. you should be well covered now.
And that's it for now.
I will see you in the next list.