Amazon
Amazon is a global technology company best known for its e-commerce platform, digital streaming, consumer electronics, and cloud computing services. Amazon has grown to become one of the world’s largest retailers and technology innovators, serving millions of customers worldwide across a diverse range of products and services—including Amazon Web Services (AWS), which powers cloud infrastructure for organizations of all sizes.
Getting data in
We recommend starting with Selecting the best method for Amazon data ingestion and then looking in more detail at options for the source types listed below.
| Source | Add-ons and Apps | Guidance |
|---|---|---|
AWSAmazon Web Services provides on-demand cloud computing platforms and APIs to individuals, companies, and governments, on a metered pay-as-you-go basis. These cloud computing web services provide various services related to networking, compute, storage, middleware, IOT, and other processing capacity, as well as software tools via AWS server farms. This frees clients from managing, scaling, and patching hardware and operating systems, and provides a way of obtaining large-scale computing capacity more quickly and cheaply than building an actual physical server farm. |
Splunk platform Splunk Enterprise Security Splunk SOAR |
Configuration
Use Cases |
CloudTrailCloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. You can use it to log, continuously monitor, and retain account activity related to actions across your AWS infrastructure. In the Common Information Model, CloudTrail log data is typically mapped to the Authentication and Change data models. CloudTrail data provides event history of your AWS account activity, including actions taken through the AWS Management Console, AWS SDKs, command line tools, and other AWS services. It increases visibility into your user and resource activity by recording AWS Management Console actions and API calls so you can detect unusual activity. |
Splunk SOAR |
Configuration
Use cases |
CloudWatchCloudWatch is a service that provides data and actionable insights for AWS, hybrid, and on-premises applications and infrastructure resources. CloudWatch enables you to monitor your complete stack and leverage alarms, logs, and events data to take automated actions and reduce Mean Time to Resolution (MTTR). CloudWatch collects, aggregates, and summarizes compute utilization information like CPU, memory, disk, and network data, as well as diagnostic information like container restart failures, to help DevOps engineers isolate issues and resolve them quickly. CloudWatch gives you actionable insights that help you optimize application performance, manage resource utilization, and understand system-wide operational health. It allows you to perform historical analysis for cost optimization and derive real-time insights into optimizing applications and infrastructure resources. |
Splunk platform |
Configuration Use Case |
Elastic Cloud Compute (EC2) |
Splunk SOAR |
Use Cases |
Elastic Kubernetes Service (EKS)Elastic Kubernetes Service (EKS) is a managed container service to run and scale Kubernetes applications in the cloud or on-premises. |
Splunk Observability Cloud |
Configuration
Splunk Resources |
Identity and Access Management (IAM)Identity and Access Management (IAM) provides fine-grained access control across all of AWS. With IAM, you can specify who can access which services and resources, and under which conditions. With IAM policies, you manage permissions to your workforce and systems to ensure least-privilege permissions. |
Splunk SOAR |
Use Cases |
Kinesis Firehose |
Splunk platform |
Configuration |
LambdaLambda is a compute service that lets you run code without provisioning or managing servers. Lambda runs your code on a high-availability compute infrastructure and performs all of the administration of the compute resources, including server and operating system maintenance, capacity provisioning and automatic scaling, code monitoring and logging. |
Splunk SOAR |
Configuration
Use Cases |
Relational Database Service (RDS)Amazon RDS (Relational Database Service) is a managed database service that simplifies the setup, operation, and scaling of relational databases in the cloud. It supports multiple database engines, including MySQL, PostgreSQL, and SQL Server, while automating time-consuming tasks like backups, patching, and scaling. RDS is commonly used for application databases, reporting, or data warehousing. |
|
Use Cases |
Security Token Service |
Splunk SOAR |
|
Security Hub |
Splunk SOAR |
Use Cases |
Simple Storage Service (S3)Amazon Simple Storage Service (S3) is a scalable object storage service that enables users to store and retrieve any amount of data from anywhere on the web. S3 is widely used for backup, archiving, content distribution, and data analytics. |
Splunk SOAR |
Use Cases
|
VPC FlowVPC Flow logs contain a comprehensive record of network traffic in and out of your AWS environment. By default, the record includes values for the different components of the IP flow, including the source, destination, and protocol. They are often used for troubleshooting connectivity issues across your VPCs, intrusion detection, or anomaly detection. In the Common Information Model, VPC flow log data is typically mapped to the Network Traffic Data model. |
|
Configuration Use Cases |
Web Application Firewall |
Splunk platform Splunk SOAR |