Use AWS IoT Device Defender and Splunk to monitor the security posture of your IoT application

This article discusses how to monitor the security posture of IoT applications using AWS IoT Device Defender, Amazon Kinesis Data Firehose, and the Splunk Platform.

Specifically, the article covers:

• An overview of the solution architecture that integrates AWS IoT Device Defender, Kinesis Data Firehose, and Splunk to aggregate and analyze IoT device security metrics
• How the solution works, including the flow of device-side metrics, cloud-side metrics, and audit findings from AWS IoT Device Defender to Splunk
• Deploying the solution using an AWS Serverless Application Model (SAM) template
• Configuring AWS IoT Device Defender for metrics publishing and audits
• Analyzing security events in Splunk using the Splunk Processing Language (SPL), with examples for monitoring open TCP ports and audit findings
• Conclusion on leveraging AWS IoT Device Defender and Splunk for IoT security monitoring