USE CASE EXAMPLE
Query + Amazon Security Lake
Elevate Your SecDataOps Game With Query and Amazon Security Lake
Overview
Amazon Security Lake automatically centralizes an organization’s security data from across their AWS environments, leading SaaS providers, on-premises and cloud sources into a purpose-built data lake. It also uses the Open Cybersecurity Schema Framework (OCSF), making it easier for security teams to automatically collect, combine, and analyze security data.
Query is a federated search solution that enables security professionals to make better data-driven decisions, faster. Query delivers a simple search & analytics interface and automatic dashboarding on top of Security Lake so security teams – from SOC analysts to threat hunters to security architects – can quickly access, search, and get answers from data stored in Security Lake.
Together, Query and Amazon Security Lake give customers a purpose-built security data lake that aggregates, normalizes and optimizes large volumes of disparate log and event data, along with a search and analytics interface that will feel familiar to security professionals of any skill level.
Features:
- Search & analytics interface providing a normalized view of all connected data sources
- Out-of-the-Box Dashboards for Findings, Entities, Application Activity, Discovery Events, IAM, Network Activity, and System Activity
- An AI-powered Query Copilot assists users with data summaries, recommended remediations, follow up actions, and more
- Support for all AWS first-party data sources & a pre-built connector to map any custom data source
- Identification of table format, OCSF version, and mappings are handled automatically. All event classes supported for OCSF 1.0.0-rc2, 1.1.0, 1.2.0 and 1.3.0 with backwards compatibility
- Serves as a query planner and translation engine atop every table in Security Lake plus over 30 additional connected data sources
Benefits:
- Faster, more accurate investigation outcomes
- Eliminate analyst time lost to pivoting across multiple tools and browser tabs
- Reduce or eliminate the need to build and maintain data pipelines
- Simplify your compliance monitoring and reporting
- Analyze multiple years of security data quickly
- Unify security data management across hybrid environments
- Flexible & extensible security data architecture
- Optimize costs by decoupling search & analytics from data storage
How it Works
Industry Feedback
Query + AWS Partner Network
AWS Partner Network — Software Path — Verified Solution
Amazon Security Lake — Subscriber Partner