Centralizing SaaS Audit Logs with AWS AppFabric - OCSF Standardization and Security Lake Integration
This article explains collecting audit logs from SaaS applications with AppFabric, standardizing them to OCSF format, and building analysis pipelines.
Overview of AppFabric
AppFabric is a service that standardizes and centralizes audit logs from SaaS applications. The multiple SaaS applications used by enterprises (Okta, Google Workspace, Slack, Salesforce, Microsoft 365, and others) each have their own log formats and APIs, and cross-cutting security analysis required developing individual connectors. AppFabric automatically converts these audit logs to OCSF (Open Cybersecurity Schema Framework) format and delivers them to S3 or Security Lake. With AppFabric, you connect SaaS applications without writing code, and you add SaaS applications through configuration. As of 2024, it supports SaaS applications such as Okta, Microsoft 365, Google Workspace, Slack, Zoom, Dropbox, Asana, and Webex by Cisco.
Log Standardization and Analysis
Each SaaS application uses its own log format, which makes cross-cutting analysis difficult. By standardizing logs to OCSF format, AppFabric lets you analyze "which user performed which action in which SaaS application" in a unified way. OCSF is an open schema under the Linux Foundation that defines common fields for each event category, such as Authentication, Authorization, File Activity, and API Activity. This standardization allows you to search Okta login failures and Microsoft 365 unauthorized access attempts across services with the same query. When you deliver logs to Security Lake, you can combine SaaS logs with CloudTrail, VPC Flow Logs, and GuardDuty findings and understand the security posture of the entire organization. For user access visibility, you can detect SaaS accounts that have not logged in for 30 days or more and use the results to review licenses.
Integration with Security Lake
When you specify Security Lake as the AppFabric output destination, SaaS audit logs are ingested into Security Lake in OCSF format, and you can analyze them together with AWS service logs (CloudTrail, VPC Flow Logs). You can run cross-service queries in Athena, such as "all SaaS applications that a specific user accessed in the past 24 hours", and use them to investigate insider threats and account compromises. Direct output to S3 is also possible, and you use it when forwarding logs to an existing SIEM (Splunk, Datadog). In the AppFabric ingestion settings, you register the credentials for each SaaS application and set the log retrieval interval.
Use Cases and Deployment Patterns
The main use cases of AppFabric fall broadly into three categories. The first is security incident investigation. It detects anomalous behavior, such as an employee who is about to leave downloading a large number of files or a login from an unusual country, by cross-referencing the logs of multiple SaaS applications. The second is compliance auditing. Obtaining SOC 2 or ISO 27001 certification requires evidence of "who accessed which SaaS application and when", and querying the logs aggregated by AppFabric directly in Athena can reduce the effort of collecting evidence for audits. The third is reviewing SaaS licenses. You visualize the number of active users and use it to decide whether to cancel unused licenses. As a deployment pattern, one approach is to connect the identity platform (Okta/Azure AD) and file sharing (Google Drive/SharePoint) first, and start by visualizing high-risk operations (permission changes / external sharing).
Pricing and Limitation Considerations
AppFabric charges are based on the number of events ingested. Charges vary with the usage scale of your SaaS applications, and details and examples are on the AWS AppFabric Pricing page. Output to Security Lake is included in the AppFabric charges, but Security Lake storage and Athena query charges are billed separately. One limitation to note is that AppFabric specializes in audit logs (who did what) and does not retrieve content data within SaaS applications (email bodies, file contents). In addition, because the supported SaaS applications are being expanded over time, you need to check in advance whether the SaaS applications your company uses are included in the supported list. Retrieval intervals differ by SaaS application, ranging from near real time to delays of several hours, so for detection where real-time response is important, consider using it together with GuardDuty or similar services. For cost management, one approach is to introduce the SaaS applications to be audited in stages, starting from applications with high security risk (authentication, file sharing).
The Value of SaaS Security Visibility
As the number of SaaS applications an enterprise uses grows, their audit logs are scattered across each service in different formats, and it becomes difficult to understand overall security. AppFabric aggregates the audit logs of multiple SaaS applications and unifies them into a common standard format. This makes cross-service analysis possible and allows you to detect signs of threats, such as suspicious logins and permission changes, in one place. If you bring the standardized logs into your security analysis foundation, you can use them in combination with your existing monitoring systems. When you integrate and visualize the SaaS security information that was scattered, it becomes easier to understand the security status of the entire organization.
Summary
AppFabric is a service that standardizes / aggregates the audit logs of multiple SaaS applications in OCSF format. It unifies the proprietary log formats of each SaaS application, and integration with Security Lake lets you analyze cloud and SaaS security logs across services. You can use it for three use cases (security incident investigation, compliance auditing, and license review), and you can add SaaS applications through configuration without developing connectors.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
- AWS AppFabric official page
- Amazon Security Lake official page
- Amazon S3 official page
- AWS Documentation (official)
If this page and the official documentation disagree, treat the official documentation as authoritative.