Setting the file. One moment.
Subchapter 41.22
references/security-lake.mdMarkdown2 KBView on GitHub
Amazon Security Lake centralizes security data from AWS services and third-party sources into a purpose-built data lake in OCSF format. It ingests CloudTrail events, VPC Flow Logs, Route 53 DNS, S3/Lambda data events, EKS audit logs, Security Hub CSPM findings, and WAF logs into customer-owned S3 buckets for analysis and long-term retention.
graph LR
CT[CloudTrail Mgmt Events] --> SL[Security Lake]
VPC[VPC Flow Logs] --> SL
R53[Route 53 DNS] --> SL
S3[S3 Data Events] --> SL
LAM[Lambda Data Events] --> SL
EKS[EKS Audit Logs] --> SL
SH[Security Hub CSPM Findings] --> SL
WAF[WAF Logs] --> SL
SL -->|stores as OCSF| S3B[Customer S3 Bucket]| API | Purpose |
|---|---|
securitylake:ListDataLakes | Check data lake enablement per region |
securitylake:GetDataLakeSources | Get configured AWS sources |
securitylake:ListLogSources | List log sources with detail |
securitylake:ListSubscribers | List subscribers |
securitylake:GetSubscriber | Get subscriber details |
securitylake:GetDataLakeOrganizationConfiguration | Get org auto-enable settings |
securitylake:ListDataLakeExceptions | List account/region exceptions |
cloudwatch:GetMetricStatistics | Get per-source ingestion volume metrics (optional, on request) |
Security Lake does not generate findings or assign severity scores. It stores security data from other services in OCSF format. Severity scoring is determined by the originating service (GuardDuty, Inspector, etc.).
get-metric-statistics via CloudWatch) only when user asks about ingestion volume. Do not query CloudWatch metrics by default.Security Lake configuration APIs reveal:
Present source enablement and subscriber summary first. Offer full configuration details on request.