Amazon Security Lake

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Overview

Amazon Security Lake is a security data lake for aggregating and managing security log and event data.

This integration ingests security logs stored in Amazon Security Lake into Datadog for further investigation and real-time threat detection. To learn more about Amazon Security Lake, visit the Amazon Security Lake user guide in AWS.

Setup

Prerequisites

Amazon Security Lake must be configured for your AWS account or AWS organization. See the Amazon Security Lake user guide for more details.
You must have a Datadog account that is using both Datadog Log Management and Datadog Cloud SIEM.
If you haven’t already, set up the Amazon Web Services integration for the AWS account where Amazon Security Lake is storing data.

Note: If you only want to integrate this AWS Account to use the Amazon Security Lake integration, you can disable metric collection in the AWS integration page so that Datadog doesn’t monitor your AWS infrastructure and you are not billed for Infrastructure Monitoring.

Log collection

Add the following IAM policy to your existing DatadogIntegrationRole IAM role so that Datadog can ingest new log files added to your security lake.

{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Sid": "DatadogSecurityLakeAccess",
          "Effect": "Allow",
          "Action": [
              "s3:GetObject"
          ],
          "Resource": "arn:aws:s3:::aws-security-data-lake-*"
      }
  ]
}

In the AWS console for Amazon Security Lake, create a subscriber for Datadog and fill in the form. For more information on an Amazon Security Lake subscriber, read the Amazon Security Lake user guide.
- Enter Datadog for Subscriber name.
- Select All log and event sources or Specific log and event sources to send to Datadog.
- Select S3 as the Data access method.

Click Create to complete the subscriber creation.
Wait several minutes, then start exploring your logs from Amazon Security Lake in Datadog’s log explorer.

To learn more about how you can use this integration for real-time threat detection, check out the blog.