Question & Answer
Question
Amazon Web Services (AWS) CloudTrail is a service that enables operational and risk auditing of your AWS account. It collects audit events from Amazon S3 buckets and a Log group in the AWS CloudWatch Logs. CloudTrail allows you to continuously monitor your AWS account activity including actions taken through the Management Console, AWS SDKs, command line, and other services.
QRadar connects through Amazon Web Services' API to retrieve the CloudTrail events, providing
event parsing that not only allows for monitoring of your AWS account
activity, but also for newly created rules to alert on possible AWS
Security violations. AWS-related saved searches are used for reporting,
which allows for analyzing trends on policy and user/group changes, and
more.
In this video, you learn how to configure QRadar to retrieve logs from an AWS cloud environment source. Two use cases demonstrate how useful this integration can be to your cloud security posture.
Duration: 12 Minutes
Follow the link in related information to view the course on the IBM Security Learning Academy
Answer
The Security Learning Academy is a full service learning platform, providing various training objects and instruction options.
Related Information
Was this topic helpful?
Document Information
Modified date:
31 January 2023
UID
ibm16460843