c3.7 Add custom threat detection

When you need custom detection

Amazon GuardDuty detects a broad set of threats, but it cannot author detections for your organization-specific use cases. To build those: 1. Identify the use case. 2. Identify the log sources that hold the required data. 3. Centralize those events. 4. Write correlation rules that categorize detected offenses. 5. Alert based on the category.

Centralize with Amazon Security Lake

Amazon Security Lake centralizes logs across a multi-account environment into a data lake normalized to the Open Cybersecurity Schema Framework (OCSF). It scales to petabytes and lets SIEMs, BI tools, and Amazon Athena subscribe to or query normalized events. Keep a short window in your visualization tools while retaining years of searchable logs in the lake.

Integrate a SIEM

In hybrid or multi-cloud environments a SIEM centralizes events (on-premises, multi-cloud, AWS) and applies correlation rules to detect incidents. Most SIEMs (Splunk, IBM QRadar, Microsoft Sentinel, Sumo Logic, Exabeam, and others) can ingest AWS logs such as CloudTrail and Security Hub CSPM findings. If you prefer an AWS-native option, the SIEM on Amazon OpenSearch Service solution deploys via CloudFormation and ships with a large set of built-in detection rules.

Is AWS Security Hub a SIEM? No. A SIEM aggregates raw events and correlates them into findings; AWS Security Hub aggregates and correlates findings (from GuardDuty, Security Hub CSPM, Inspector, Macie, and more) that are already relevant for the security team to act on.