Amazon Security Lake is a fully managed security data lake service. You can use Security Lake to automatically centralize security data from cloud, on-premises, and custom sources into a data lake that's stored in your Amazon Web Services account. Amazon Web Services Organizations is an account management service that lets you consolidate multiple Amazon Web Services accounts into an organization that you create and centrally manage. With Organizations, you can create member accounts and invite existing accounts to join your organization. Security Lake helps you analyze security data for a more complete understanding of your security posture across the entire organization. It can also help you improve the protection of your workloads, applications, and data.
The data lake is backed by Amazon Simple Storage Service (Amazon S3) buckets, and you retain ownership over your data.
Amazon Security Lake integrates with CloudTrail, a service that provides a record of actions taken by a user, role, or an Amazon Web Services service. In Security Lake, CloudTrail captures API calls for Security Lake as events. The calls captured include calls from the Security Lake console and code calls to the Security Lake API operations. If you create a trail, you can enable continuous delivery of CloudTrail events to an Amazon S3 bucket, including events for Security Lake. If you don't configure a trail, you can still view the most recent events in the CloudTrail console in Event history. Using the information collected by CloudTrail you can determine the request that was made to Security Lake, the IP address from which the request was made, who made the request, when it was made, and additional details. To learn more about Security Lake information in CloudTrail, see the Amazon Security Lake User Guide.
Security Lake automates the collection of security-related log and event data from integrated Amazon Web Services and third-party services. It also helps you manage the lifecycle of data with customizable retention and replication settings. Security Lake converts ingested data into Apache Parquet format and a standard open-source schema called the Open Cybersecurity Schema Framework (OCSF).
Other Amazon Web Services and third-party services can subscribe to the data that's stored in Security Lake for incident response and security data analytics.
securitylake(
config = list(),
credentials = list(),
endpoint = NULL,
region = NULL
)A client for the service. You can call the service's operations using
syntax like svc$operation(...), where svc is the name you've assigned
to the client. The available operations are listed in the
Operations section.
Optional configuration of credentials, endpoint, and/or region.
credentials:
creds:
access_key_id: AWS access key ID
secret_access_key: AWS secret access key
session_token: AWS temporary session token
profile: The name of a profile to use. If not given, then the default profile is used.
anonymous: Set anonymous credentials.
endpoint: The complete URL to use for the constructed client.
region: The AWS Region used in instantiating the client.
close_connection: Immediately close all HTTP connections.
timeout: The time in seconds till a timeout exception is thrown when attempting to make a connection. The default is 60 seconds.
s3_force_path_style: Set this to true to force the request to use path-style addressing, i.e. http://s3.amazonaws.com/BUCKET/KEY.
sts_regional_endpoint: Set sts regional endpoint resolver to regional or legacy https://docs.aws.amazon.com/sdkref/latest/guide/feature-sts-regionalized-endpoints.html
Optional credentials shorthand for the config parameter
creds:
access_key_id: AWS access key ID
secret_access_key: AWS secret access key
session_token: AWS temporary session token
profile: The name of a profile to use. If not given, then the default profile is used.
anonymous: Set anonymous credentials.
Optional shorthand for complete URL to use for the constructed client.
Optional shorthand for AWS Region used in instantiating the client.
svc <- securitylake(
config = list(
credentials = list(
creds = list(
access_key_id = "string",
secret_access_key = "string",
session_token = "string"
),
profile = "string",
anonymous = "logical"
),
endpoint = "string",
region = "string",
close_connection = "logical",
timeout = "numeric",
s3_force_path_style = "logical",
sts_regional_endpoint = "string"
),
credentials = list(
creds = list(
access_key_id = "string",
secret_access_key = "string",
session_token = "string"
),
profile = "string",
anonymous = "logical"
),
endpoint = "string",
region = "string"
)
| create_aws_log_source | Adds a natively supported Amazon Web Service as an Amazon Security Lake source |
| create_custom_log_source | Adds a third-party custom source in Amazon Security Lake, from the Amazon Web Services Region where you want to create a custom source |
| create_data_lake | Initializes an Amazon Security Lake instance with the provided (or default) configuration |
| create_data_lake_exception_subscription | Creates the specified notification subscription in Amazon Security Lake for the organization you specify |
| create_data_lake_organization_configuration | Automatically enables Amazon Security Lake for new member accounts in your organization |
| create_subscriber | Creates a subscription permission for accounts that are already enabled in Amazon Security Lake |
| create_subscriber_notification | Notifies the subscriber when new data is written to the data lake for the sources that the subscriber consumes in Security Lake |
| delete_aws_log_source | Removes a natively supported Amazon Web Service as an Amazon Security Lake source |
| delete_custom_log_source | Removes a custom log source from Amazon Security Lake, to stop sending data from the custom source to Security Lake |
| delete_data_lake | When you disable Amazon Security Lake from your account, Security Lake is disabled in all Amazon Web Services Regions and it stops collecting data from your sources |
| delete_data_lake_exception_subscription | Deletes the specified notification subscription in Amazon Security Lake for the organization you specify |
| delete_data_lake_organization_configuration | Turns off automatic enablement of Amazon Security Lake for member accounts that are added to an organization in Organizations |
| delete_subscriber | Deletes the subscription permission and all notification settings for accounts that are already enabled in Amazon Security Lake |
| delete_subscriber_notification | Deletes the specified notification subscription in Amazon Security Lake for the organization you specify |
| deregister_data_lake_delegated_administrator | Deletes the Amazon Security Lake delegated administrator account for the organization |
| get_data_lake_exception_subscription | Retrieves the details of exception notifications for the account in Amazon Security Lake |
| get_data_lake_organization_configuration | Retrieves the configuration that will be automatically set up for accounts added to the organization after the organization has onboarded to Amazon Security Lake |
| get_data_lake_sources | Retrieves a snapshot of the current Region, including whether Amazon Security Lake is enabled for those accounts and which sources Security Lake is collecting data from |
| get_subscriber | Retrieves the subscription information for the specified subscription ID |
| list_data_lake_exceptions | Lists the Amazon Security Lake exceptions that you can use to find the source of problems and fix them |
| list_data_lakes | Retrieves the Amazon Security Lake configuration object for the specified Amazon Web Services Regions |
| list_log_sources | Retrieves the log sources in the current Amazon Web Services Region |
| list_subscribers | List all subscribers for the specific Amazon Security Lake account ID |
| list_tags_for_resource | Retrieves the tags (keys and values) that are associated with an Amazon Security Lake resource: a subscriber, or the data lake configuration for your Amazon Web Services account in a particular Amazon Web Services Region |
| register_data_lake_delegated_administrator | Designates the Amazon Security Lake delegated administrator account for the organization |
| tag_resource | Adds or updates one or more tags that are associated with an Amazon Security Lake resource: a subscriber, or the data lake configuration for your Amazon Web Services account in a particular Amazon Web Services Region |
| untag_resource | Removes one or more tags (keys and values) from an Amazon Security Lake resource: a subscriber, or the data lake configuration for your Amazon Web Services account in a particular Amazon Web Services Region |
| update_data_lake | Specifies where to store your security data and for how long |
| update_data_lake_exception_subscription | Updates the specified notification subscription in Amazon Security Lake for the organization you specify |
| update_subscriber | Updates an existing subscription for the given Amazon Security Lake account ID |
| update_subscriber_notification | Updates an existing notification method for the subscription (SQS or HTTPs endpoint) or switches the notification subscription endpoint for a subscriber |
if (FALSE) {
svc <- securitylake()
svc$create_aws_log_source(
Foo = 123
)
}
Run the code above in your browser using DataLab