Risk Insights for AWS Entities
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、
お気軽にご連絡ください。
Overview
Cloud SIEM’s Risk Insights for AWS Entities consolidates multiple data sources, such as SIEM threats and CSM insights, into a profile representing a single security entity, such as an IAM user.
With Risk Insights, you can:
- Explore entities, filtering them by attributes such as risk score severity and configuration risks.
- View all data relevant to an entity, such as signals, misconfigurations, and identity risks.
- Triage relevant items in bulk.
- Take mitigation steps such as creating a global suppression or creating a case for an entity.
Prerequisites
Explore risk insights
Query and filter entities
On the Risk Insights Explorer, you can view all entities that have a non-zero risk score associated to them.
Quickly build context on an entity
Click an entity in the Explorer to open the entity side panel.
The What Happened section of the panel summarizes the count of signals, misconfigurations, and identity risks and how they have contributed to the risk score, as well as any potential configuration risks.
The What contributes to the score section displays the list of fired signals, relevant misconfigurations, and identity risks.
Triage and mitigate threats in bulk
The Next steps section of the entity side panel includes the available mitigation steps for SIEM signals, misconfigurations, and identity risks.
Risk scoring
An entity’s risk score approximates the entity’s risk level over the past 14 days of activity.
The risk score is calculated from the characteristics of the entity’s associated signals, such as the severity level of the signal and how many times the signal has fired.
Further reading
