securitylake: Amazon Security Lake

In paws: Amazon Web Services Software Development Kit

Amazon Security Lake

Description

Amazon Security Lake is a fully managed security data lake service. You can use Security Lake to automatically centralize security data from cloud, on-premises, and custom sources into a data lake that's stored in your Amazon Web Services account. Amazon Web Services Organizations is an account management service that lets you consolidate multiple Amazon Web Services accounts into an organization that you create and centrally manage. With Organizations, you can create member accounts and invite existing accounts to join your organization. Security Lake helps you analyze security data for a more complete understanding of your security posture across the entire organization. It can also help you improve the protection of your workloads, applications, and data.

The data lake is backed by Amazon Simple Storage Service (Amazon S3) buckets, and you retain ownership over your data.

Amazon Security Lake integrates with CloudTrail, a service that provides a record of actions taken by a user, role, or an Amazon Web Services service. In Security Lake, CloudTrail captures API calls for Security Lake as events. The calls captured include calls from the Security Lake console and code calls to the Security Lake API operations. If you create a trail, you can enable continuous delivery of CloudTrail events to an Amazon S3 bucket, including events for Security Lake. If you don't configure a trail, you can still view the most recent events in the CloudTrail console in Event history. Using the information collected by CloudTrail you can determine the request that was made to Security Lake, the IP address from which the request was made, who made the request, when it was made, and additional details. To learn more about Security Lake information in CloudTrail, see the Amazon Security Lake User Guide.

Security Lake automates the collection of security-related log and event data from integrated Amazon Web Services and third-party services. It also helps you manage the lifecycle of data with customizable retention and replication settings. Security Lake converts ingested data into Apache Parquet format and a standard open-source schema called the Open Cybersecurity Schema Framework (OCSF).

Other Amazon Web Services and third-party services can subscribe to the data that's stored in Security Lake for incident response and security data analytics.

Usage

securitylake(
  config = list(),
  credentials = list(),
  endpoint = NULL,
  region = NULL
)

Arguments

config	Optional configuration of credentials, endpoint, and/or region. credentials: creds: access_key_id: AWS access key ID secret_access_key: AWS secret access key session_token: AWS temporary session token profile: The name of a profile to use. If not given, then the default profile is used. anonymous: Set anonymous credentials. endpoint: The complete URL to use for the constructed client. region: The AWS Region used in instantiating the client. close_connection: Immediately close all HTTP connections. timeout: The time in seconds till a timeout exception is thrown when attempting to make a connection. The default is 60 seconds. s3_force_path_style: Set this to true to force the request to use path-style addressing, i.e. ⁠http://s3.amazonaws.com/BUCKET/KEY⁠. sts_regional_endpoint: Set sts regional endpoint resolver to regional or legacy https://docs.aws.amazon.com/sdkref/latest/guide/feature-sts-regionalized-endpoints.html
credentials	Optional credentials shorthand for the config parameter creds: access_key_id: AWS access key ID secret_access_key: AWS secret access key session_token: AWS temporary session token profile: The name of a profile to use. If not given, then the default profile is used. anonymous: Set anonymous credentials.
endpoint	Optional shorthand for complete URL to use for the constructed client.
region	Optional shorthand for AWS Region used in instantiating the client.

Value

A client for the service. You can call the service's operations using syntax like svc$operation(...), where svc is the name you've assigned to the client. The available operations are listed in the Operations section.

Service syntax

svc <- securitylake(
  config = list(
    credentials = list(
      creds = list(
        access_key_id = "string",
        secret_access_key = "string",
        session_token = "string"
      ),
      profile = "string",
      anonymous = "logical"
    ),
    endpoint = "string",
    region = "string",
    close_connection = "logical",
    timeout = "numeric",
    s3_force_path_style = "logical",
    sts_regional_endpoint = "string"
  ),
  credentials = list(
    creds = list(
      access_key_id = "string",
      secret_access_key = "string",
      session_token = "string"
    ),
    profile = "string",
    anonymous = "logical"
  ),
  endpoint = "string",
  region = "string"
)

Operations

create_aws_log_source	Adds a natively supported Amazon Web Service as an Amazon Security Lake source
create_custom_log_source	Adds a third-party custom source in Amazon Security Lake, from the Amazon Web Services Region where you want to create a custom source
create_data_lake	Initializes an Amazon Security Lake instance with the provided (or default) configuration
create_data_lake_exception_subscription	Creates the specified notification subscription in Amazon Security Lake for the organization you specify
create_data_lake_organization_configuration	Automatically enables Amazon Security Lake for new member accounts in your organization
create_subscriber	Creates a subscription permission for accounts that are already enabled in Amazon Security Lake
create_subscriber_notification	Notifies the subscriber when new data is written to the data lake for the sources that the subscriber consumes in Security Lake
delete_aws_log_source	Removes a natively supported Amazon Web Service as an Amazon Security Lake source
delete_custom_log_source	Removes a custom log source from Amazon Security Lake, to stop sending data from the custom source to Security Lake
delete_data_lake	When you disable Amazon Security Lake from your account, Security Lake is disabled in all Amazon Web Services Regions and it stops collecting data from your sources
delete_data_lake_exception_subscription	Deletes the specified notification subscription in Amazon Security Lake for the organization you specify
delete_data_lake_organization_configuration	Turns off automatic enablement of Amazon Security Lake for member accounts that are added to an organization in Organizations
delete_subscriber	Deletes the subscription permission and all notification settings for accounts that are already enabled in Amazon Security Lake
delete_subscriber_notification	Deletes the specified notification subscription in Amazon Security Lake for the organization you specify
deregister_data_lake_delegated_administrator	Deletes the Amazon Security Lake delegated administrator account for the organization
get_data_lake_exception_subscription	Retrieves the details of exception notifications for the account in Amazon Security Lake
get_data_lake_organization_configuration	Retrieves the configuration that will be automatically set up for accounts added to the organization after the organization has onboarded to Amazon Security Lake
get_data_lake_sources	Retrieves a snapshot of the current Region, including whether Amazon Security Lake is enabled for those accounts and which sources Security Lake is collecting data from
get_subscriber	Retrieves the subscription information for the specified subscription ID
list_data_lake_exceptions	Lists the Amazon Security Lake exceptions that you can use to find the source of problems and fix them
list_data_lakes	Retrieves the Amazon Security Lake configuration object for the specified Amazon Web Services Regions
list_log_sources	Retrieves the log sources in the current Amazon Web Services Region
list_subscribers	List all subscribers for the specific Amazon Security Lake account ID
list_tags_for_resource	Retrieves the tags (keys and values) that are associated with an Amazon Security Lake resource: a subscriber, or the data lake configuration for your Amazon Web Services account in a particular Amazon Web Services Region
register_data_lake_delegated_administrator	Designates the Amazon Security Lake delegated administrator account for the organization
tag_resource	Adds or updates one or more tags that are associated with an Amazon Security Lake resource: a subscriber, or the data lake configuration for your Amazon Web Services account in a particular Amazon Web Services Region
untag_resource	Removes one or more tags (keys and values) from an Amazon Security Lake resource: a subscriber, or the data lake configuration for your Amazon Web Services account in a particular Amazon Web Services Region
update_data_lake	Specifies where to store your security data and for how long
update_data_lake_exception_subscription	Updates the specified notification subscription in Amazon Security Lake for the organization you specify
update_subscriber	Updates an existing subscription for the given Amazon Security Lake account ID
update_subscriber_notification	Updates an existing notification method for the subscription (SQS or HTTPs endpoint) or switches the notification subscription endpoint for a subscriber

Examples

## Not run: 
svc <- securitylake()
svc$create_aws_log_source(
  Foo = 123
)

## End(Not run)

paws documentation built on Sept. 17, 2024, 5:07 p.m.