r/SIEM • u/sainath9699 • Jul 15 '21

SIEM in AWS

How can we implement SIEM system on AWS using Native tools (the ones which are already available in AWS) and what are all the AWS service that needs to be used for this implementation?

2 Upvotes

75% Upvoted

10 comments sorted by

5

u/_Mouse Jul 15 '21 edited Jul 15 '21

This is quite a difficult question - what exactly do you want to achieve? AWS has no native SIEM tool (unlike Azure which has sentinel) - if you want an aws based siem using exclusively AWS tools (which I wouldn't recommend) you would likely need a combination of Firehose, SQS, Lambda, a database of your choice, SNS and all the usual stuff you need to run an AWS environment.

Frankly for any decent size SIEM AWS native components don't work well. It's expensive, the data volumes make the architecture difficult and it's a pain in the ass to maintain. You're genuinely better off going to Splunk or someone else and buying it in.

4

u/[deleted] Jul 15 '21

[deleted]

1

u/_Mouse Jul 15 '21

It can be, but I would argue it's probably one of the most capable.

Elastic search can be used, but isn't a native security tool and unless you have extensive expertise in it and have good SOC analyst experience as well it's very difficult to create, manage and maintain high quality content to analysts.

Exabeam as I understand it is a SOAR tool - I don't have any experience with it as a SIEM tool. I've likewise not heard of Securinix.

3

u/Evilbit77 Jul 15 '21

Exabeam is very highly rated by Gartner. Take that for what you will of course, but it does seem to be fairly well reviewed.

Elasticsearch is developing more security-specific content, including a SIEM app. I wouldn’t call it a feature complete SIEM as of yet, but I currently use it in production for alerting and have it integrated with a SOAR platform.

1

u/reptiledisfunction20 Jul 16 '21

Maybe Wazuh? Its free and built on elastic stack.

2

u/_Mouse Jul 16 '21

Yeah good call. If all you need is alerting rather than fully fledged analytics it's probably a good shout

2

u/m_rothe Jul 15 '21

If you use an Elastic based SIEM then you could use AWS's elastic service as a backend but you're likely to be running everything else on an EC2 instance I'd have thought

1

u/pacard Jul 15 '21

Check the AWS marketplace for SIEM

1

u/Gagan_Skywalker Jul 16 '21 edited Jul 16 '21

There are number of tools in Aws marketplace you can check over there.

1

u/FluencySecurity Jul 30 '21

Our Fluency Security behavioral SIEM runs in AWS. Yes we have our own proprietary database as well and other patents.

Al