Security Monitoring and Detection

Security Monitoring and Detection An architecture diagram generated by Archify. Runtime · Network · Identity Security · includes identity and access · Detection Types Runtime · Network · Identity Security includes identity and access Configuration Security · cluster configuration checks · Detection Types Configuration Security cluster configuration checks Amazon CloudWatch · logs · metrics · Architecture component Amazon CloudWatch logs · metrics Amazon GuardDuty · EKS Protection · Architecture component Amazon GuardDuty EKS Protection Falco · runtime anomaly detection · Architecture component Falco runtime anomaly detection AWS Security Hub · central security posture · Architecture component AWS Security Hub central security posture kube-audit · configuration checks · Architecture component kube-audit configuration checks Data Collection · Threat Detection Workflow Data Collection Data Analysis · Threat Detection Workflow Data Analysis Threat Detection · Threat Detection Workflow Threat Detection Response · Threat Detection Workflow Response Remediation · Threat Detection Workflow Remediation runtime identity and access report findings Detection Types Threat Detection Workflow Legend Threat Detection Workflow AWS Security Services Detection Types Kubernetes Security Tools

AWS Security Services

  • • GuardDuty EKS Protection: runtime threat detection via the EKS_RUNTIME_MONITORING feature
  • • Security Hub: central security posture management with the AWS Foundational Security Best Practices standard

Kubernetes Security Tools

  • • Falco: installed via Helm for runtime security monitoring and anomaly detection
  • • kube-audit: cluster configuration security checks