Well, topic of this video is managing security, monitoring, alerting, auditing, and what do you
do when an incident happens?
If in general you also talk about any incident, any accident happens, you would like to know how it
happened so you can prevent it later on while something is happening, like, for example, someone
breaks security, there should be some alarm that triggers and you get alerted.
So innovativeness also.
And any security for that matter, you have tools and services that can monitor for events.
You can track back and see what happened this time and you can even respond to that.
We know clergies and monitoring service or a monitoring service from a W.S. so we can have logs, you
can stream logs to cloud watch and we can read their log.
Mattrick, you know, if you happen to find some IP addresses or something that you don't want in your
infrastructure and it can send an alarm to you.
Our response to respond to any events or some cloud really is one source which will record all the entries,
all the EPA calls that is made to your eatables account.
So anything that you do in your account, either through console, through command line, programmatically,
all this makes Epper calls to any place and all these calls can be recorded.
You can record it in a service called Cloud Drill and then you can save it on an extra bucket encrypted.
I already explained to you about encryption how you can use Schamus for encryption.
So the story is that your story in history books should be encrypted, so not everyone has access to
it because the really important information, very critical information in that people should not be
able to see it.
And also, in case the cyber criminal wants to remove their footprints, they will not be able to do
that if they are not able to find the content industry, but it's encrypted, then the cyber criminals
will not be able to remove their entries also.
So the footprints will be regarded as an lamda.
Services have different EPA calls and their incident.
So they're epicycles.
Their trails can be recorded separately.
One more services are going to see in this video the config which will create configuration of your
entire eatables infrastructure and will save it, and you can watch the configuration in a time line.
What is changed to when?
And you can even have rules.
We checks for a particular configuration, like, for example, 22 open from anywhere, if you have
such kind of security group where you have put to open from anywhere, then it can even alert you or
even can fix such problems.
But don't really play too much with this eatables conflict service because it is still very expensive
and you will be charged based on the number of rules.
So more rules, more charges.
So you can do create one rule.
See how it works and then you can just delete that.
OK, so let's go to trial first and see how we can record epicycles.
So much for the service cloud trail or even just such trail.
And here in the U.S., in the SOS, there are some recent events, it will not show you all the events.
If you want to have all the events, then you can create a trail so you can click on create real.
Can Utrillo name I see all API calls, something like that, you can do it for all the regions or you
can be honest on the specific region, not Virginia.
I am so I can be know.
Recording only API calls in North Virginia, but recommended, as you recall, obviously all the calls
you can apply at an organization level.
So it gets recorded for multiple accounts.
You have all use in that.
We have seen Eatables organization.
So I'm not going to do it for the organization, just for this account, what kind of events you want
to record, you want to record all or only read-only or only.
Right, or you don't want to record anything.
Obviously, we want to record something.
So and we keep all.
Also, do you want to record Eatables Schamus events and also, yes, of course, I want to record that
maybe someone tries to disable the key so those things can be recorded.
Right?
Some log inside also it can record, but that's going to be very expensive, so we can skip that for
now, Astraea and Lambrakis all will not be recorded.
But if you want to do that, then you can just do it all here itself.
You now select only three bucket and record all the API calls and also for Lambretta, you can do it
for all or you can select your function.
So we'll skip that.
Because this can turn out to be very expensive, also stepstool stolen of a lot of data.
So if you're hosting something publicly, there'll be too many calls coming to your city, Buckcherry
vehicles and you know, your Cloudera logs will just shut up and you'll have a lot of.
So it really depends whether you want to record this or not.
So it is an option.
Storage, where you want to store all this so you can create a new bucket that will create an extra
bucket for you, but very important points over here.
If a cyber criminal makes an attempt to get in, they will also want to remove their footprints.
So you're recording everything through cloud trail, but they can remove your or their logs, their
entries, and you will not find anything.
And so first thing is, we encrypted the.
So they cannot find I already have a key Miski, so I can select that.
And other one is in log file validation, even some makes some makes changes to remove what you can
run some like commands and you can really check whether the logs are tampered or not.
If it's tampered, it will throw you messages at DDD files.
There's some tampering happen.
If not, your log files are good.
You would also like to send email notification.
Still out.
Oh, I see, Buchard, I have to give name honestly, Buchard, I will see.
She'll logs and do some random number.
Create.
OK, it seems I don't have I don't have sufficient privilege to access this key Miski, so I'll go to
CMS.
I find my key.
And let's see that it's pending deletion, of course.
So instead of canceling that, I will create a new Kamiński.
Is a cloud drill.
IFN.
Cames, I think he.
OK, house and e-mail notification to my house and this topic.
OK, let's create it now.
All right, so that is great.
You should have also created one more whiskey for us.
And there it is, so make sure you delete it once this exercise is done or schedule to delete, it will
be deleted in seven days if you schedule for seven days.
So Trelease enable now any any changes to do anything, any baycol we do, it will be record and it
will be sent to the three bucket.
So we'll find the AC Buchard.
Three.
So the FCC budget, we should have a direct Ramblas logs inside that we have the account idea and you
have Cloudera Lakshya anyhow digest here when you want to check the validation that time you can use
their digest logs will be here so you will see a different region.
I have now enabled for all the regions.
I should see all the region.
If you selected one region, you should see only one region.
So 20, 20.
One month.
OK, there we have a zip file.
Let's download that.
So in the file, you should see some kind of adjacent values, it will be very long is just one line
over here.
If you wait for some time, you will see in every region you'll have a lot of files and you'll have
a lot of logs.
So if you see here from this account, I read this with this X's, this is the username.
Some calls were made and you can really understand that.
Who made the call from where the call was made, what service was used to?
All the details will be recorded.
A clouting does not support few services, though.
Of course, the latest services, a deep learning eatables artifact.
We use that in our project that is not supported snowmobile Samarian, but most of the major services
will be supported.
You can see all the services.
I go over here, all the services, EPA calls will be recorded and you'll see this, most of them.
If you want to validate whether you're Cloudera log are right or not going to check its integrity if
anyone tampered or not, so you can use a Calacanis documented.
It's an example of lost clout, trail, validate logs start time and time you give you give the trail
name and it will print whether it's valid or not.
OK, so the output you should get something like that's going to compare with the Digest and it will
tell you whether these low points are valid or not, if there is any improvement happen, you will find
that.
So that was what clout will.
Now, if you see all the violence and if you tried all those things, you can delete your Tryal.
You can stop logging.
You can even delete the trace.
Make sure you delete the Kamus key or schedule the deletion so you don't get charged for it Skidelsky
deletion.
To 70 conform schedule.
We'll check out Naxos, which is the config service.
Just search for config.
Config is really simple service to use, but it's also very expensive.
So if you would like to skip this exercise, you can skip, but, you know, you can try at least one
rule and then you can delete that.
So let's get started with this.
So McLoud trial records, all the EPA calls, config records, all the configuration, the current state
of your Indianapolis account, it will record you can also include global resources like AM.
You can mention a bucket name that's going to receive the configuration.
And we need a rule, so it will create a rule if you put this checkmark on and let's go next.
So that first was about creating the configuration of your own on the second step is about rule.
Do you want to set some rule like one of the most famous rule is Secich, right?
You want to check whether any port is such is open anywhere?
I like that there are so many other rules in the documentation.
If you go and check, you can write your own rules.
Also, you can check whether Valve is enabled, enabled or not in application load balancer or if your
account is part of the organization or not.
Someone tries to leave the organization.
So, you know, you get a notification, right?
So like that.
There are so many amazing rules that go with a very simple one, which we understand mostly restricted
Secich.
So it will check with a security group that are using are allowing this is not for everyone.
And you can from.
Right now, we don't see anything rules if we go, we can see the rules, it's evaluating, it's checking
whether it's in compliance or not, your configuration is in compliance or not.
It come back to dashboard.
You can see things like Ecija security.
Gruder 15 is 12, easy to subnet and how we network interface you roundtable.
How many have network initially?
How hard it's going to record all that.
OK, which is pretty awesome if you ask me.
Looking at your entire configuration, just one place and you see rules, it says one is non-compliant.
We had to set one rule, if you remember, is a search and is somewhere it is non-compliant.
Let's see.
So something is noncompliant.
And that's the security group.
Let's see, what is that security group?
OK, that's the security group, the.
So if we go to a rescue, let's go to YouTube and find that security group and let's fix it, this was
created by the Bienstock.
OK, you know, the security group of Bienstock 22 open from anywhere, right.
So that should be the problem.
Which is good.
We got to know it now.
Let's call the security group.
Let's go to security group.
Right, that one inbound rule, so you should see 22 open from anywhere, right.
And see how quickly, how easily it found that.
And we can see that you can send notifications also for that.
Let's fix it.
I'll say 20 dolefully from my IPSC rule.
OK, now let's go back in some time, it will see that everything is in compliance.
So it's still not showing it's in compliance.
Let's check out Raoul.
OK, it is compliant after some time, what you can do is you can also make some changes.
Go back.
You can see edit action.
Ed.
And you can select one dish should really do the evaluation for all the changes only for resources or
for a specific Dagg.
You can do that and no more does an evaluation.
Mobiling will be there.
OK, so things are not in compliance.
But I made one more issue, actually, one more another security group.
I put twenty two and I'll wait for it to find that out.
One compliant rule.
OK, let's go to security group.
That security group, let's click on that, so those changes happen in the security group, you can
see resource timeline, this really awesome thing.
It will show you the timeline when your configuration was changed.
See that with November 20, 28, this time evaluated and the next change happened at this particular
time, you can see the changes also.
All right, there is a compliance timeline where it will show you when it was it became compliant at
this particular time.
So you can see all the changes like that that's happening on your resources.
So al-sarraf lot of not many more things, you can create your own rule, you can put more rules, but
I really don't recommend you play in your free direction with config because it can be very expensive.
So once you're done with this exercise, you can go to settings and you can see edit and you can see,
you know, uncheck this.
So it stops regarding.
And Jesse.
I can go to rules.
And remove your rule.
So keep this for your interview focus or, you know, if you get some task like this, Gafoor, those
kinds of things, you keep that information or else, you know, if you try to play more than be huge
bull's.
The dashboard.
So wait for some time, it will disabled regarding the rule, Williger deleted.
Keep watching that.
Clean all this, once you're done, you can check the next video that should be all in the studio.
I'll see you in the next one.