Learn R Programming

paws.security.identity (version 0.7.0)

securitylake: Amazon Security Lake

Description

Amazon Security Lake is a fully managed security data lake service. You can use Security Lake to automatically centralize security data from cloud, on-premises, and custom sources into a data lake that's stored in your Amazon Web Services account. Amazon Web Services Organizations is an account management service that lets you consolidate multiple Amazon Web Services accounts into an organization that you create and centrally manage. With Organizations, you can create member accounts and invite existing accounts to join your organization. Security Lake helps you analyze security data for a more complete understanding of your security posture across the entire organization. It can also help you improve the protection of your workloads, applications, and data.

The data lake is backed by Amazon Simple Storage Service (Amazon S3) buckets, and you retain ownership over your data.

Amazon Security Lake integrates with CloudTrail, a service that provides a record of actions taken by a user, role, or an Amazon Web Services service. In Security Lake, CloudTrail captures API calls for Security Lake as events. The calls captured include calls from the Security Lake console and code calls to the Security Lake API operations. If you create a trail, you can enable continuous delivery of CloudTrail events to an Amazon S3 bucket, including events for Security Lake. If you don't configure a trail, you can still view the most recent events in the CloudTrail console in Event history. Using the information collected by CloudTrail you can determine the request that was made to Security Lake, the IP address from which the request was made, who made the request, when it was made, and additional details. To learn more about Security Lake information in CloudTrail, see the Amazon Security Lake User Guide.

Security Lake automates the collection of security-related log and event data from integrated Amazon Web Services and third-party services. It also helps you manage the lifecycle of data with customizable retention and replication settings. Security Lake converts ingested data into Apache Parquet format and a standard open-source schema called the Open Cybersecurity Schema Framework (OCSF).

Other Amazon Web Services and third-party services can subscribe to the data that's stored in Security Lake for incident response and security data analytics.

Usage

securitylake(
  config = list(),
  credentials = list(),
  endpoint = NULL,
  region = NULL
)

Value

A client for the service. You can call the service's operations using syntax like svc$operation(...), where svc is the name you've assigned to the client. The available operations are listed in the Operations section.

Arguments

config

Optional configuration of credentials, endpoint, and/or region.

  • credentials:

    • creds:

      • access_key_id: AWS access key ID

      • secret_access_key: AWS secret access key

      • session_token: AWS temporary session token

    • profile: The name of a profile to use. If not given, then the default profile is used.

    • anonymous: Set anonymous credentials.

  • endpoint: The complete URL to use for the constructed client.

  • region: The AWS Region used in instantiating the client.

  • close_connection: Immediately close all HTTP connections.

  • timeout: The time in seconds till a timeout exception is thrown when attempting to make a connection. The default is 60 seconds.

  • s3_force_path_style: Set this to true to force the request to use path-style addressing, i.e. http://s3.amazonaws.com/BUCKET/KEY.

  • sts_regional_endpoint: Set sts regional endpoint resolver to regional or legacy https://docs.aws.amazon.com/sdkref/latest/guide/feature-sts-regionalized-endpoints.html

credentials

Optional credentials shorthand for the config parameter

  • creds:

    • access_key_id: AWS access key ID

    • secret_access_key: AWS secret access key

    • session_token: AWS temporary session token

  • profile: The name of a profile to use. If not given, then the default profile is used.

  • anonymous: Set anonymous credentials.

endpoint

Optional shorthand for complete URL to use for the constructed client.

region

Optional shorthand for AWS Region used in instantiating the client.

Service syntax

svc <- securitylake(
  config = list(
    credentials = list(
      creds = list(
        access_key_id = "string",
        secret_access_key = "string",
        session_token = "string"
      ),
      profile = "string",
      anonymous = "logical"
    ),
    endpoint = "string",
    region = "string",
    close_connection = "logical",
    timeout = "numeric",
    s3_force_path_style = "logical",
    sts_regional_endpoint = "string"
  ),
  credentials = list(
    creds = list(
      access_key_id = "string",
      secret_access_key = "string",
      session_token = "string"
    ),
    profile = "string",
    anonymous = "logical"
  ),
  endpoint = "string",
  region = "string"
)

Operations

create_aws_log_sourceAdds a natively supported Amazon Web Service as an Amazon Security Lake source
create_custom_log_sourceAdds a third-party custom source in Amazon Security Lake, from the Amazon Web Services Region where you want to create a custom source
create_data_lakeInitializes an Amazon Security Lake instance with the provided (or default) configuration
create_data_lake_exception_subscriptionCreates the specified notification subscription in Amazon Security Lake for the organization you specify
create_data_lake_organization_configurationAutomatically enables Amazon Security Lake for new member accounts in your organization
create_subscriberCreates a subscription permission for accounts that are already enabled in Amazon Security Lake
create_subscriber_notificationNotifies the subscriber when new data is written to the data lake for the sources that the subscriber consumes in Security Lake
delete_aws_log_sourceRemoves a natively supported Amazon Web Service as an Amazon Security Lake source
delete_custom_log_sourceRemoves a custom log source from Amazon Security Lake, to stop sending data from the custom source to Security Lake
delete_data_lakeWhen you disable Amazon Security Lake from your account, Security Lake is disabled in all Amazon Web Services Regions and it stops collecting data from your sources
delete_data_lake_exception_subscriptionDeletes the specified notification subscription in Amazon Security Lake for the organization you specify
delete_data_lake_organization_configurationTurns off automatic enablement of Amazon Security Lake for member accounts that are added to an organization in Organizations
delete_subscriberDeletes the subscription permission and all notification settings for accounts that are already enabled in Amazon Security Lake
delete_subscriber_notificationDeletes the specified notification subscription in Amazon Security Lake for the organization you specify
deregister_data_lake_delegated_administratorDeletes the Amazon Security Lake delegated administrator account for the organization
get_data_lake_exception_subscriptionRetrieves the details of exception notifications for the account in Amazon Security Lake
get_data_lake_organization_configurationRetrieves the configuration that will be automatically set up for accounts added to the organization after the organization has onboarded to Amazon Security Lake
get_data_lake_sourcesRetrieves a snapshot of the current Region, including whether Amazon Security Lake is enabled for those accounts and which sources Security Lake is collecting data from
get_subscriberRetrieves the subscription information for the specified subscription ID
list_data_lake_exceptionsLists the Amazon Security Lake exceptions that you can use to find the source of problems and fix them
list_data_lakesRetrieves the Amazon Security Lake configuration object for the specified Amazon Web Services Regions
list_log_sourcesRetrieves the log sources in the current Amazon Web Services Region
list_subscribersList all subscribers for the specific Amazon Security Lake account ID
list_tags_for_resourceRetrieves the tags (keys and values) that are associated with an Amazon Security Lake resource: a subscriber, or the data lake configuration for your Amazon Web Services account in a particular Amazon Web Services Region
register_data_lake_delegated_administratorDesignates the Amazon Security Lake delegated administrator account for the organization
tag_resourceAdds or updates one or more tags that are associated with an Amazon Security Lake resource: a subscriber, or the data lake configuration for your Amazon Web Services account in a particular Amazon Web Services Region
untag_resourceRemoves one or more tags (keys and values) from an Amazon Security Lake resource: a subscriber, or the data lake configuration for your Amazon Web Services account in a particular Amazon Web Services Region
update_data_lakeSpecifies where to store your security data and for how long
update_data_lake_exception_subscriptionUpdates the specified notification subscription in Amazon Security Lake for the organization you specify
update_subscriberUpdates an existing subscription for the given Amazon Security Lake account ID
update_subscriber_notificationUpdates an existing notification method for the subscription (SQS or HTTPs endpoint) or switches the notification subscription endpoint for a subscriber

Examples

Run this code
if (FALSE) {
svc <- securitylake()
svc$create_aws_log_source(
  Foo = 123
)
}

Run the code above in your browser using DataLab