Did we implement this wrong or does aws expect you to stitch the findings together yourself
So we spent much of last quarter trying to make Security Hub + GuardDuty + Inspector + IAM Analyzer + Config work as a full security stack. Give tools covering posture, threat detection, vuln scanning, identity and compliance. We quickly realized its like having 5 tools each in a separate corner waving at each other.
I mean Guardduty flags an anomalous API call and security hub has no idea which resource was touched or whether the calling role was overprivileged. Meanwhile IAM analyzer finds an overprivileged service account. Inspector has a critical cve on the instance using that account. Basically 3 separate findings in 3 consoles and most of the time someone has to manually join the dots.
What where I stand, the isn’t the detection, the’re very good here. But could have been way better if these tools can pick things like a guardduty finding + an overprivileged IAM role + an exposed S3 bucket aren't three separate problems. They're one attack path. Multiaccount makes it worse
So here's where i'm stuck, either we completely botched the implementation and there's a way to make these play or AWS built five tools that each do one thing well and left the correlation as an exercise for the user.
Thing is we don't want to throw money at yet at a vendor if the answer cloud be just configure it properly. But I also don't want to keep burning engineering hours stitching together dashboards.