Client

securitylake

R Documentation

Amazon Security Lake¶

Description¶

Amazon Security Lake is a fully managed security data lake service. You can use Security Lake to automatically centralize security data from cloud, on-premises, and custom sources into a data lake that's stored in your Amazon Web Services account. Amazon Web Services Organizations is an account management service that lets you consolidate multiple Amazon Web Services accounts into an organization that you create and centrally manage. With Organizations, you can create member accounts and invite existing accounts to join your organization. Security Lake helps you analyze security data for a more complete understanding of your security posture across the entire organization. It can also help you improve the protection of your workloads, applications, and data.

The data lake is backed by Amazon Simple Storage Service (Amazon S3) buckets, and you retain ownership over your data.

Amazon Security Lake integrates with CloudTrail, a service that provides a record of actions taken by a user, role, or an Amazon Web Services service. In Security Lake, CloudTrail captures API calls for Security Lake as events. The calls captured include calls from the Security Lake console and code calls to the Security Lake API operations. If you create a trail, you can enable continuous delivery of CloudTrail events to an Amazon S3 bucket, including events for Security Lake. If you don't configure a trail, you can still view the most recent events in the CloudTrail console in Event history. Using the information collected by CloudTrail you can determine the request that was made to Security Lake, the IP address from which the request was made, who made the request, when it was made, and additional details. To learn more about Security Lake information in CloudTrail, see the Amazon Security Lake User Guide.

Security Lake automates the collection of security-related log and event data from integrated Amazon Web Services and third-party services. It also helps you manage the lifecycle of data with customizable retention and replication settings. Security Lake converts ingested data into Apache Parquet format and a standard open-source schema called the Open Cybersecurity Schema Framework (OCSF).

Other Amazon Web Services and third-party services can subscribe to the data that's stored in Security Lake for incident response and security data analytics.

Usage¶

securitylake(
  config = list(),
  credentials = list(),
  endpoint = NULL,
  region = NULL
)

Arguments¶

config

Optional configuration of credentials, endpoint, and/or region.

credentials:
- creds:
  - access_key_id: AWS access key ID
  - secret_access_key: AWS secret access key
  - session_token: AWS temporary session token
- profile: The name of a profile to use. If not given, then the default profile is used.
- anonymous: Set anonymous credentials.
endpoint: The complete URL to use for the constructed client.
region: The AWS Region used in instantiating the client.
close_connection: Immediately close all HTTP connections.
timeout: The time in seconds till a timeout exception is thrown when attempting to make a connection. The default is 60 seconds.
s3_force_path_style: Set this to true to force the request to use path-style addressing, i.e. ⁠http://s3.amazonaws.com/BUCKET/KEY⁠.
sts_regional_endpoint: Set sts regional endpoint resolver to regional or legacy https://docs.aws.amazon.com/sdkref/latest/guide/feature-sts-regionalized-endpoints.html

credentials

Optional credentials shorthand for the config parameter

creds:
- access_key_id: AWS access key ID
- secret_access_key: AWS secret access key
- session_token: AWS temporary session token
profile: The name of a profile to use. If not given, then the default profile is used.
anonymous: Set anonymous credentials.

endpoint

Optional shorthand for complete URL to use for the constructed client.

region

Optional shorthand for AWS Region used in instantiating the client.

Value¶

A client for the service. You can call the service's operations using syntax like svc$operation(...), where svc is the name you've assigned to the client. The available operations are listed in the Operations section.

Service syntax¶

svc <- securitylake(
  config = list(
    credentials = list(
      creds = list(
        access_key_id = "string",
        secret_access_key = "string",
        session_token = "string"
      ),
      profile = "string",
      anonymous = "logical"
    ),
    endpoint = "string",
    region = "string",
    close_connection = "logical",
    timeout = "numeric",
    s3_force_path_style = "logical",
    sts_regional_endpoint = "string"
  ),
  credentials = list(
    creds = list(
      access_key_id = "string",
      secret_access_key = "string",
      session_token = "string"
    ),
    profile = "string",
    anonymous = "logical"
  ),
  endpoint = "string",
  region = "string"
)

Operations¶

create_aws_log_source: Adds a natively supported Amazon Web Service as an Amazon Security Lake source
create_custom_log_source: Adds a third-party custom source in Amazon Security Lake, from the Amazon Web Services Region where you want to create a custom source
create_data_lake: Initializes an Amazon Security Lake instance with the provided (or default) configuration; Creates the specified notification subscription in Amazon Security Lake for the organization you specify; Automatically enables Amazon Security Lake for new member accounts in your organization
create_subscriber: Creates a subscription permission for accounts that are already enabled in Amazon Security Lake
create_subscriber_notification: Notifies the subscriber when new data is written to the data lake for the sources that the subscriber consumes in Security Lake
delete_aws_log_source: Removes a natively supported Amazon Web Service as an Amazon Security Lake source
delete_custom_log_source: Removes a custom log source from Amazon Security Lake, to stop sending data from the custom source to Security Lake
delete_data_lake: When you disable Amazon Security Lake from your account, Security Lake is disabled in all Amazon Web Services Regions and it stops collecting data from your sources; Deletes the specified notification subscription in Amazon Security Lake for the organization you specify; Turns off automatic enablement of Amazon Security Lake for member accounts that are added to an organization in Organizations
delete_subscriber: Deletes the subscription permission and all notification settings for accounts that are already enabled in Amazon Security Lake
delete_subscriber_notification: Deletes the specified notification subscription in Amazon Security Lake for the organization you specify; Deletes the Amazon Security Lake delegated administrator account for the organization
get_data_lake_exception_subscription: Retrieves the details of exception notifications for the account in Amazon Security Lake; Retrieves the configuration that will be automatically set up for accounts added to the organization after the organization has onboarded to Amazon Security Lake
get_data_lake_sources: Retrieves a snapshot of the current Region, including whether Amazon Security Lake is enabled for those accounts and which sources Security Lake is collecting data from
get_subscriber: Retrieves the subscription information for the specified subscription ID
list_data_lake_exceptions: Lists the Amazon Security Lake exceptions that you can use to find the source of problems and fix them
list_data_lakes: Retrieves the Amazon Security Lake configuration object for the specified Amazon Web Services Regions
list_log_sources: Retrieves the log sources in the current Amazon Web Services Region
list_subscribers: List all subscribers for the specific Amazon Security Lake account ID
list_tags_for_resource: Retrieves the tags (keys and values) that are associated with an Amazon Security Lake resource: a subscriber, or the data lake configuration for your Amazon Web Services account in a particular Amazon Web Services Region; Designates the Amazon Security Lake delegated administrator account for the organization
tag_resource: Adds or updates one or more tags that are associated with an Amazon Security Lake resource: a subscriber, or the data lake configuration for your Amazon Web Services account in a particular Amazon Web Services Region
untag_resource: Removes one or more tags (keys and values) from an Amazon Security Lake resource: a subscriber, or the data lake configuration for your Amazon Web Services account in a particular Amazon Web Services Region
update_data_lake: Specifies where to store your security data and for how long; Updates the specified notification subscription in Amazon Security Lake for the organization you specify
update_subscriber: Updates an existing subscription for the given Amazon Security Lake account ID
update_subscriber_notification: Updates an existing notification method for the subscription (SQS or HTTPs endpoint) or switches the notification subscription endpoint for a subscriber

Examples¶

## Not run: 
svc <- securitylake()
svc$create_aws_log_source(
  Foo = 123
)

## End(Not run)