Monitoring AWS Services

With over 200 AWS-managed services, it is hard to know every possible attack vector, and even harder to defend against all of them. Fortunately, roughly 80% of attacks on AWS services can be detected with just 20% of SOC effort. This room focuses on the most common and impactful attacks targeting AWS services, and explores how to detect them using CloudTrail and other cloud logs.

Learning Objectives

• Learn the risks of exposed S3 and RDS, and practice the defenses
• Understand the workflows to detect insecure EC2 security groups
• Learn about the emerging Denial of Wallet attacks targeting AWS
• Practice the material in Splunk via CloudTrail and GuardDuty datasets

Prerequisites

• AWS Security Logging
• Splunk: The Basics
• Preferably, Introduction to AWS module
• Preferably, SOC Level 1 Analyst path

Lab Access

Start the lab by clicking the Start Machine button below. You will then have access to the Splunk Web Interface. Please wait 4-5 minutes for the Splunk instance to launch. To access Splunk, follow this link:

• https://LAB_WEB_URL.p.thmlabs.com (opens in new tab)

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting the Target Machine, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.

Target machine

Status:Off

Start Machine