How Affirm Reduced Manual Security Triage By 50% With AWS And Expel

Affirm successfully reduced manual security triage by 50% using Amazon Web Services (AWS) and Expel. This achievement allowed their engineers to focus on higher-value tasks, significantly reducing alert fatigue.

You Should Know:

To achieve similar results in your environment, here are some practical commands and tools you can use:

1. AWS CLI for Security Monitoring:

List all security findings in AWS GuardDuty:

aws guardduty list-findings --detector-id <detector-id>

Automate responses to security alerts using AWS Lambda:

aws lambda invoke --function-name <function-name> --payload file://input.json output.json

2. Linux Commands for Log Analysis:

Monitor real-time logs for suspicious activity:

tail -f /var/log/syslog | grep "fail|error"

Analyze login attempts:

grep "Failed password" /var/log/auth.log

3. Windows PowerShell for Security Audits:

Check for failed login attempts:

Get-EventLog -LogName Security -InstanceId 4625

Export security logs for further analysis:

Export-Csv -Path "C:\SecurityLogs.csv" -InputObject (Get-EventLog -LogName Security)

4. Automating Alerts with Expel-like Tools:

Use SIEM tools like Splunk or ELK Stack to centralize and automate alerts:

curl -X POST -H "Content-Type: application/json" -d '{"query": "search error"}' http://<splunk-server>:8088/services/search/jobs

What Undercode Say:

Reducing manual security triage is critical for improving operational efficiency. By leveraging AWS services like GuardDuty and Lambda, combined with tools like Expel, organizations can automate repetitive tasks and focus on strategic initiatives. Additionally, using Linux and Windows commands for log analysis and security audits can further enhance your cybersecurity posture. For more details on AWS and Expel integration, visit AWS Expel Partnership.

Remember, automation is key to combating alert fatigue and ensuring your team can focus on what truly matters.