Monitoring AWS Workloads

There are many ways to run applications and tasks in the cloud. Lab machines on EC2, containers, and serverless Lambda functions are among the most common workload types. Although they can all run the same code, each introduces its own monitoring challenges. In this room, you will explore the features of common AWS workloads, how attackers target them, and how to monitor them using Falco and CloudTrail.

Learning Objectives

• Learn about EC2 Systems Manager and EC2 Auto Scaling
• Explore the challenges when monitoring containers in AWS
• Discover Falco as a tool for container-aware runtime monitoring
• Dive into less common attacks involving AWS Lambda functions
• Practice the material in Splunk via CloudTrail and Falco datasets

Prerequisites

• AWS Security Logging
• Splunk: The Basics
• Preferably, Introduction to AWS module
• Preferably, SOC Level 1 Analyst path

Lab Access

Start the lab by clicking the Start Lab Machine button below. You will then have access to the Splunk Web Interface. Please wait 4-5 minutes for the Splunk instance to launch. To access Splunk, follow this link:

• https://LAB_WEB_URL.p.thmlabs.com (opens in new tab)

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting the Lab Machine, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.

Lab machine

Status:Off

Start Lab Machine