AWS AppFabric New2023年〜
A service that standardizes and aggregates audit logs from SaaS applications
What It Does
AWS AppFabric is a service that automatically collects audit logs from SaaS applications like Slack, Salesforce, and Google Workspace, standardizes them into OCSF (Open Cybersecurity Schema Framework) format, and aggregates them into S3 or Security Lake. By unifying each SaaS application's proprietary format, it streamlines cross-platform security analysis and compliance efforts.
Use Cases
AppFabric is used for centralizing security monitoring across multiple SaaS applications, visualizing employee SaaS usage, and automating audit log collection and retention for compliance. The more SaaS applications an IT department manages, the greater the benefit of centralized management through AppFabric.
Everyday Analogy
Think of it like a multilingual translation service. When reports from different countries (SaaS apps) arrive in their respective languages (proprietary formats), comparing and analyzing them is difficult. The translation service (AppFabric) converts all reports into a common language (OCSF), so you can grasp the overall situation at a glance.
What Is AppFabric?
AWS AppFabric is a service for centrally managing audit logs from multiple SaaS applications used by an organization. Modern businesses use numerous SaaS tools like Slack, Microsoft 365, Salesforce, and Zoom. Each SaaS outputs logs in its own proprietary format, making cross-platform security analysis difficult. AppFabric converts these logs into a standard format and aggregates them in one place.
Log Standardization and Aggregation
AppFabric automatically retrieves audit logs from connected SaaS applications and converts them into OCSF (Open Cybersecurity Schema Framework), an industry-standard schema. The converted logs can be output to S3 buckets or Security Lake. Since the format is unified, you can run cross-platform queries with Athena or OpenSearch to detect suspicious activity.
Supported SaaS Applications
AppFabric supports major SaaS applications including Slack, Microsoft 365, Google Workspace, Salesforce, Zoom, Dropbox, and Okta. Connections to each SaaS are made via OAuth authentication, and API key management is handled automatically by AppFabric. Supported SaaS applications are continuously being added, covering most commonly used business applications. For more details on supported SaaS applications, you can also check reference books on Amazon.
Getting Started
In the AppFabric console, create an app bundle and select the SaaS applications you want to connect. Authenticate with each SaaS via OAuth, then specify the log destination (such as an S3 bucket). Once configured, automatic audit log collection begins. The collected logs are output in OCSF format, so you can start analyzing right away.
Things to Watch Out For
- AppFabric pricing is based on log ingestion volume, so costs vary depending on the number of connected SaaS apps and log volume
- Due to API rate limits on the SaaS side, large volumes of logs may not be retrievable all at once. Initial log ingestion may take time when first connecting
- Supported SaaS applications are limited, so verify that your SaaS tools are supported before getting started
