<p>A single alert from one security service tells you something happened. Read that signal alongside activity from other services and your own business context, and you will know whether what happened is part of a multi-stage attack.</p>
<p>Consider a short sequence. An identity calls <code class="CodeInline" style="color: #000">GetCallerIdentity</code> from a source address it hasn’t previously used. Within minutes, that same identity runs a burst of <code class="CodeInline" style="color: #000">List</code> and <code class="CodeInline" style="color: #000">Describe</code> calls across several services, and some of them fail with <code class="CodeInline" style="color: #000">AccessDenied</code>. Soon after, a large volume of data leaves your environment toward a domain that was registered last week. <span class="LinkEnhancement"><a class="Link" href="https://aws.amazon.com/guardduty" target="_blank" rel="noopener" data-cms-ai="0">Amazon GuardDuty</a></span> might already flag pieces of this, such as the reconnaissance from an unfamiliar source, through finding types like <code class="CodeInline" style="color: #000">Recon:IAMUser/*</code> or <code class="CodeInline" style="color: #000">Discovery:S3/*</code>. What you gain from correlating the pieces yourself is a single view of the sequence, tied to your own business context, so you can act on the whole rather than triaging findings one at a time.</p>
<p>This post is for security engineers and security operations teams who run <span class="LinkEnhancement"><a class="Link" href="https://aws.amazon.com/" target="_blank" rel="noopener" data-cms-ai="0">Amazon Web Services (AWS)</a></span> detection services and want to catch patterns specific to their environment. You will see how AWS detection and your business context fit together, and how to build correlations that use that context. The examples run in <span class="LinkEnhancement"><a class="Link" href="https://aws.amazon.com/cloudwatch/" target="_blank" rel="noopener" data-cms-ai="0">Amazon CloudWatch</a></span> Logs Insights so you can try them today, and the closing section describes how to grow them into an automated pipeline. The walkthrough later in this post lists the prerequisites for these queries.</p>
<div class="RichTextHeading">
<h2>Start with AWS detection services</h2>
</div>
<p>Begin with the AWS detection services. They cover the threats common across customers, and everything in this post is built on them.</p>
<ul id="rte-c582fda1-6df4-11f1-a6d0-cd73b326b66c" class="rte2-style-ul">
<li><span class="LinkEnhancement"><a class="Link" href="https://docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html" target="_blank" rel="noopener" data-cms-ai="0">Amazon GuardDuty</a></span> analyzes activity across <span class="LinkEnhancement"><a class="Link" href="https://aws.amazon.com/cloudtrail/" target="_blank" rel="noopener" data-cms-ai="0">AWS CloudTrail</a></span>, <span class="LinkEnhancement"><a class="Link" href="https://aws.amazon.com/vpc" target="_blank" rel="noopener" data-cms-ai="0">Amazon Virtual Private Cloud (Amazon VPC)</a></span> Flow Logs, DNS query logs, <span class="LinkEnhancement"><a class="Link" href="https://aws.amazon.com/s3" target="_blank" rel="noopener" data-cms-ai="0">Amazon Simple Storage Service (Amazon S3)</a></span> data events, and more and it produces high confidence findings out of the box.</li>
<li><span class="LinkEnhancement"><a class="Link" href="https://docs.aws.amazon.com/detective/latest/userguide/what-is-detective.html" target="_blank" rel="noopener" data-cms-ai="0">Amazon Detective</a></span> (a security investigation service that visualizes relationships between resources and findings) lets you investigate findings with graph-based context across services and accounts.</li>
<li><span class="LinkEnhancement"><a class="Link" href="https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html" target="_blank" rel="noopener" data-cms-ai="0">AWS Security Hub</a></span> aggregates security findings into a single prioritized dashboard.</li>
<li><span class="LinkEnhancement"><a class="Link" href="https://docs.aws.amazon.com/security-lake/latest/userguide/what-is-security-lake.html" target="_blank" rel="noopener" data-cms-ai="0">Amazon Security Lake</a></span> centralizes security data into a purpose-built data lake, stored in the <span class="LinkEnhancement"><a class="Link" href="https://ocsf.io/" target="_blank" rel="noopener" data-cms-ai="0">Open Cybersecurity Schema Framework (OCSF)</a&