Centralizing SaaS Audit Logs with AWS AppFabric - OCSF Standardization and Security Lake Integration
Learn how AppFabric collects audit logs from SaaS applications, standardizes them to OCSF format, and builds analysis pipelines.
Overview of AppFabric
AppFabric is a service that standardizes and centralizes audit logs from SaaS applications. The multiple SaaS tools used by enterprises (Okta, Google Workspace, Slack, Salesforce, Microsoft 365, etc.) each have their own log formats and APIs, and cross-cutting security analysis previously required developing individual connectors. AppFabric automatically converts these audit logs to OCSF (Open Cybersecurity Schema Framework) format and delivers them to S3 or Security Lake. This eliminates the need to develop and maintain connectors, and adding new SaaS applications requires only configuration.
Log Standardization and Analysis
Each SaaS application uses its own log format, making cross-cutting analysis difficult. By standardizing to OCSF format, AppFabric enables unified analysis of "which user performed which action in which SaaS application." Delivering to Security Lake lets you integrate SaaS logs with CloudTrail, VPC Flow Logs, and GuardDuty findings to understand the security posture of the entire organization. For user access visibility, you can detect SaaS accounts with no login activity for 30 days or more and use the findings for license optimization.
Integration with Security Lake
When you specify Security Lake as AppFabric's output destination, SaaS audit logs are ingested into Security Lake in OCSF format and can be analyzed alongside AWS service logs (CloudTrail, VPC Flow Logs). Use Athena to run cross-service queries like "all SaaS applications accessed by a specific user in the past 24 hours" to streamline insider threat and account compromise investigations. Direct output to S3 is also available for forwarding logs to existing SIEMs (Splunk, Datadog). In AppFabric's ingestion settings, you register authentication credentials for each SaaS application and configure the log retrieval interval. To deepen your understanding of AppFabric, specialized books on Amazon can also be helpful.
AppFabric Pricing
AppFabric is billed based on the number of events ingested, at approximately $0.50 per million events. Costs vary depending on the usage scale of your SaaS applications. Output to Security Lake is included in AppFabric pricing, but Security Lake storage and Athena query charges are billed separately. Select SaaS applications for auditing based on priority, and rather than ingesting all SaaS applications uniformly, introduce them incrementally starting with high-security-risk applications (authentication, file sharing) to manage costs.
Summary
AppFabric is a service that standardizes and centralizes audit logs from multiple SaaS applications in OCSF format. It unifies the proprietary log formats of each SaaS application and, through integration with Security Lake, enables cross-cutting analysis of cloud and SaaS security logs. It streamlines insider threat and account compromise investigations and improves security visibility across the entire organization.