CloudHunter Amazon ECS Integration
Sift Security CloudHunter integrates with Amazon EC2 Container Service (ECS) to enable improved visibility and enhance detection, threat hunting, and incident response capabilities. For ECS instances, CloudHunter provides high-fidelity anomaly detection results to identify potentially compromised instances. CloudHunter considers the quality of the baseline when determining how to prioritize alerts. Because containers are generally single-purpose and homogeneous, they have highly predictable baselines, from which CloudHunter can easily identify and prioritize abnormal behavior. CloudHunter also provides useful visualizations around ECS Instances, such as which auto scaling groups and images they are created from, and what users are responsible for any changes made to them.
The screenshot below shows CloudHunter being used to investigate a compromised ECS instance. The graph shows all the instances of a container, with an alert for one of the nine instances exhibiting unusual behavior. The alert (in red) shows unusual network traffic, indicating a potentially malicious login from an unusual geo-location. CloudHunter enables you to take mitigate actions directly from the canvas, selecting the compromised instance (highlighted in blue) and shutting it down.