4 ms·
Can anyone explain how this works? They're scanning logs of what? Suspicious interaction of a service, or suspicious command line fu? You know, for science.
by reducesuffering 9y ago
Can anyone explain how this works? They're scanning logs of what? Suspicious interaction of a service, or suspicious command line fu? You know, for science.
- vasco 9y agoIt uses VPC flow logs.
- cddotdotslash 9y agoThey're ingesting several data sources, including CloudTrail (IAM events in the account) and VPC flow logs (network activity) to look for suspicious behavior. For example, if someone disables CloudTrail logging, that API event is suspicious, especially if it comes from outside your organization. If your EC2 instances start pinging known Bitcoin mining servers, that's probably something you want to fix as well.