Question

A security engineer at a company with 40 AWS accounts under AWS Organizations wants to reduce the time analysts spend correlating logs during investigations. Analysts currently pull VPC Flow Logs, CloudTrail events, and GuardDuty findings manually from each account to understand the scope of suspicious activity. The engineer needs a service that automatically ingests these data sources across all member accounts and presents an interactive visualization showing relationships between entities such as IAM roles, IP addresses, and EC2 instances over time. Which approach meets this requirement with the least ongoing operational effort?

Accepted Answer

Enable Amazon Detective from the delegated administrator account so it automatically ingests CloudTrail, VPC Flow Logs, and GuardDuty findings across the organization into a behavior graph.

Answer

Build an Amazon Athena workgroup that queries a centralized S3 bucket of CloudTrail and VPC Flow Logs, and visualize the results in Amazon QuickSight dashboards.

Answer

Configure AWS Security Hub as the delegated administrator and use its findings aggregation to correlate log data across accounts automatically.

Answer

Deploy an Amazon OpenSearch Service cluster and stream logs from each account with Kinesis Data Firehose, then use OpenSearch Dashboards to graph entity relationships.