Centralized SOC Architectures on AWS

Опубликовано 20 июня 2019, 20:29

As AWS customers continue to adopt and migrate workloads to the platform, they are adopting multi-account and multi-regional deployments to incorporate DR/COOP into their enterprise architectures while managing blast radius, account limits costs, and security. This session is focused on enabling a centralized SOC account for organizations running multi-account, multi-region workloads on AWS. The centralized SOC account on AWS has 2 primary purposes: (1) centralize data and visibility to quickly detect incidents, and (2) provide event driven automation for responding to and recovering from incidents.