Amazon Web Services (AWS) Security Monitoring

Integrate Seamlessly with AWS

Securonix monitors various AWS components for signs of malicious activity that may signal an advanced or targeted attack. Our solution collects and analyzes logs across various AWS activities including:

• Login events
• Amazon Elastic Compute Cloud (EC2) configuration events
• Elastic Load Balancing (ELB) logs
• Amazon Virtual Private Cloud (VPC) connection logs
• AWS Identity and Access Management (IAM) activities and more.

Cover Key AWS Use Cases

Securonix enriches and correlates events from AWS with contextual data and event logs from other on-premises and cloud data sources in order to monitor for insider and cyber threat patterns. Key use cases include:

• Unauthorized access from a login or from a rare IP or geolocation
• Amazon EC2 configuration anomalies such as a spike in instance creation or deletion, suspicious admin activities, or a rare instance.
• Suspicious AWS IAM activity like a suspicious user creation, admin privilege changes, password policy changes, or rare privileged activity.
• Anomalous API connections including from a rare IP or geolocation, or a malicious IP address.
• Suspicious Amazon VPC traffic including port scans or connections on anomalous ports

Detect Faster with AWS-Specific Threat Models

A direct API integration with the AWS stack provides you with the relevant event logs needed to uncover unknown threats. Securonix correlates events with contextual information from other on-premises data feeds to trace low and slow threats across your entire environment.