E15 · Woori FIS · Feb 2026 – Oct 2026
Alerts from many accounts on one screen
- GuardDuty
- Security Hub
- Splunk
- SIEM
Summary
I connected GuardDuty, Security Hub, and Splunk SIEM to monitor security events across multiple AWS accounts in one place.
Background
- GuardDuty: the AWS threat detection service. It finds threats such as unusual traffic or suspected credential theft.
- Security Hub: collects results from several security services in one format.
- SIEM: a system that gathers security logs from many systems for analysis. Here, that is Splunk.
What I did
I connected the three to monitor security events across multiple AWS accounts in one place.