Lesson 10 — Amazon EventBridge, Security Automation, SOAR & Event-Driven Incident Response

Learning Path

☁️ Phase 02 – AWS Cloud Security

📘 Module 13 – Enterprise Security Operations, Logging, Monitoring & Threat Detection

🎯 Lesson Objectives

By the end of this lesson, you will be able to:

Explain Amazon EventBridge architecture.
Understand event-driven architectures.
Configure EventBridge event buses.
Create EventBridge rules.
Configure event patterns.
Route security events.
Integrate AWS security services.
Build automated incident response workflows.
Implement SOAR concepts using AWS services.
Trigger AWS Lambda automation.
Integrate Systems Manager Automation.
Configure SNS notifications.
Build enterprise event-driven architectures.
Reduce Mean Time to Respond (MTTR).
Design enterprise security automation.
Build automated remediation workflows.
Secure EventBridge.
Design enterprise governance.
Build Security Operations playbooks.
Apply EventBridge best practices.

📚 Lesson Information

Area	Details
Estimated Time	8–10 Hours
Difficulty	Advanced
Prerequisites	Lesson 09 – Amazon Inspector
Hands-on Labs	Yes
AWS Services	Amazon EventBridge, AWS Lambda, Systems Manager, SNS, Security Hub, GuardDuty, CloudTrail, AWS Config

💼 Business Scenario

CloudNova Technologies has deployed:

AWS CloudTrail
Amazon CloudWatch
AWS Config
Amazon GuardDuty
AWS Security Hub
Amazon Detective
Amazon Inspector

The Security Operations Centre (SOC) receives security findings quickly, but analysts still perform many repetitive manual tasks.

Examples include:

Assigning incidents to analysts.
Sending notification emails.
Creating ITSM tickets.
Isolating compromised EC2 instances.
Removing public S3 bucket permissions.
Quarantining IAM users.
Triggering malware scans.
Tagging compromised resources.
Updating investigation status.
Notifying management teams.

Manual response delays have increased the Mean Time to Respond (MTTR).

The Chief Information Security Officer (CISO) asks:

“How can we automate repetitive security operations while maintaining governance, approvals and auditability?”

As CloudNova’s Cloud Security Architect, you are responsible for implementing Amazon EventBridge as the enterprise event routing and security automation platform.

1. Introduction to Amazon EventBridge

Topics:

What is Amazon EventBridge?
Event-driven architecture.
Event routing.
Security automation.
Operational automation.
Decoupled applications.
SOAR fundamentals.

2. EventBridge Architecture

Explain:

Event Producers
Event Bus
Rules
Event Patterns
Targets
Dead Letter Queues (DLQs)
Archives
Replay

Architecture Diagram

AWS Services

↓

Security Events

↓

Amazon EventBridge

↓

Rules

↓

Targets

↓

Lambda

↓

Systems Manager

↓

SNS

↓

SOC

↓

Incident Response

3. EventBridge Components

Explain:

Default Event Bus
Custom Event Bus
Partner Event Bus
Event Rules
Event Patterns
Targets
Archives
Replay
Schema Registry

4. Event-Driven Architecture

Topics:

Producers
Consumers
Loose coupling
Event routing
Asynchronous processing
Enterprise integrations

Benefits:

Scalability
Flexibility
Automation
Reduced operational overhead

5. Event Sources

EventBridge receives events from:

CloudTrail
Security Hub
GuardDuty
AWS Config
Inspector
IAM
EC2
S3
Lambda
Organizations
Custom Applications
SaaS Partners

6. Event Patterns

Explain:

Source
Detail Type
Detail
Resource Filters
Account Filters
Region Filters

Examples:

GuardDuty High Severity
Inspector Critical Finding
IAM Policy Change
CloudTrail StopLogging Event
Root Account Login

7. Event Routing

Route events to:

AWS Lambda
Amazon SNS
Amazon SQS
Systems Manager Automation
Step Functions
Kinesis
API Destinations

8. Security Automation

Automate:

Security notifications
Resource tagging
Quarantine actions
Ticket creation
Evidence collection
Compliance reporting
Approval workflows

9. SOAR Fundamentals

Explain:

Security Orchestration
Security Automation
Automated Response
Human Approval
Playbooks
Runbooks

Enterprise benefits:

Faster response
Consistent actions
Reduced analyst workload
Improved auditability

10. Automated Incident Response

Example workflow:

GuardDuty High Finding

↓

EventBridge

↓

Lambda

↓

Isolate EC2 Instance

↓

SNS Notification

↓

Systems Manager

↓

SOC Analyst

↓

Incident Closed

11. Lambda Integration

Automate:

Resource tagging
IAM policy updates
EC2 isolation
S3 permission changes
Finding enrichment

12. Systems Manager Integration

Automate:

Runbooks
Patch deployment
Resource isolation
Command execution
Automation documents

13. EventBridge Archives & Replay

Explain:

Event archives
Replay events
Testing
Incident simulations
Audit support

14. Enterprise Automation Use Cases

Examples:

Disable compromised IAM user
Remove public S3 access
Block malicious security groups
Notify SOC
Create ServiceNow incident
Trigger forensic evidence collection
Launch Lambda investigation
Quarantine EC2 instance

15. Enterprise Governance

Govern:

Event ownership
Rule naming
Automation approvals
Change management
Logging
Auditing
Exception handling
Documentation

16. EventBridge Security

Protect:

Event Buses
IAM permissions
Resource Policies
Encryption
Monitoring
Logging
Cross-account event sharing

17. EventBridge Threat Model

Threats include:

Unauthorised rule creation
Disabled automation
Event spoofing
Excessive IAM permissions
Missing approvals
Incorrect routing
Failed automation
Silent event loss

18. Enterprise EventBridge Architecture

CloudTrail

↓

GuardDuty

↓

Security Hub

↓

AWS Config

↓

Amazon Inspector

↓

Amazon EventBridge

↓

Lambda

↓

Systems Manager

↓

SNS

↓

SOC Dashboard

↓

Incident Response

19. Enterprise SOAR Workflow

Security Finding

↓

EventBridge Rule

↓

Event Pattern Match

↓

Automation Workflow

↓

Approval (Optional)

↓

Lambda / Systems Manager

↓

Notification

↓

Incident Response

↓

Audit Logging

20. Event-Driven Incident Response Lifecycle

Detection

↓

Event Generated

↓

EventBridge

↓

Automation Triggered

↓

Containment

↓

Evidence Collection

↓

Investigation

↓

Recovery

↓

Lessons Learned

🛠 Enterprise Labs

Lab 01

Enable Amazon EventBridge for Enterprise Security

Lab 02

Create Custom Event Buses

Lab 03

Create Security Event Rules

Lab 04

Route GuardDuty Findings to Lambda

Lab 05

Automate Security Hub Notifications

Lab 06

Trigger Systems Manager Automation

Lab 07

Quarantine an EC2 Instance Automatically

Lab 08

Create EventBridge Archives and Replay Events

Lab 09

Build an Enterprise SOAR Workflow

Lab 10

Enterprise Security Automation Assessment

💻 AWS Console Walkthrough

Students should configure:

Event Buses
Rules
Event Patterns
Targets
Archives
Replay
Schema Registry
Cross-account permissions
Integrations with GuardDuty, Security Hub and AWS Config

💻 AWS CLI Exercises

# List event buses
aws events list-event-buses

# List rules
aws events list-rules

# Describe a rule
aws events describe-rule \
  --name GuardDutyHighSeverityRule

# List targets
aws events list-targets-by-rule \
  --rule GuardDutyHighSeverityRule

# Put a new rule
aws events put-rule \
  --name CriticalSecurityFinding \
  --event-pattern file://pattern.json

# Add a Lambda target
aws events put-targets \
  --rule CriticalSecurityFinding \
  --targets file://targets.json

# List archives
aws events list-archives

# List replays
aws events list-replays

✅ Verification Checklist

Students should be able to:

Explain Amazon EventBridge architecture.
Configure Event Buses.
Create EventBridge Rules.
Design Event Patterns.
Integrate GuardDuty, Security Hub and AWS Config.
Automate security notifications.
Trigger Lambda and Systems Manager workflows.
Build enterprise SOAR workflows.
Design event-driven security automation.
Govern enterprise automation.

🏢 Enterprise Best Practices

CloudNova standards:

Use descriptive naming conventions for EventBridge rules and event buses.
Apply least privilege IAM permissions to automation workflows.
Validate event patterns before deploying to production.
Use approval workflows for high-impact remediation actions.
Log every automated action for audit and compliance purposes.
Monitor failed event deliveries and retry mechanisms.
Archive security events for testing and forensic analysis.
Regularly review automation rules to remove obsolete workflows.
Test SOAR playbooks through scheduled tabletop and technical exercises.
Document ownership and maintenance responsibilities for every automation workflow.

🚫 Common Mistakes

Automating destructive actions without safeguards.
Using overly broad event patterns that trigger excessive automation.
Ignoring failed event deliveries.
Not implementing approval workflows for critical actions.
Giving Lambda functions excessive permissions.
Failing to test automation before production deployment.
Not logging automated remediation actions.
Allowing duplicate EventBridge rules to perform conflicting actions.
Ignoring cross-account event security.
Treating automation as a replacement for analyst judgement.

🧪 DIY Enterprise Challenge

Design CloudNova’s enterprise security automation platform supporting:

500 AWS accounts
Multi-Region deployment
GuardDuty integration
Security Hub integration
AWS Config integration
Inspector integration
Lambda automation
Systems Manager Automation
Executive notifications
Enterprise SOAR operations

Prepare:

Enterprise EventBridge architecture
Event routing strategy
SOAR playbook catalogue
Automation approval workflow
Event governance framework
Security automation dashboard
Operational runbook
Continuous improvement roadmap

📊 Knowledge Check

Create and answer 50 enterprise-level questions covering:

Amazon EventBridge architecture
Event Buses
Event Rules
Event Patterns
Targets
Archives
Replay
Lambda integration
Systems Manager integration
SOAR concepts
Security automation
Event-driven architecture
Enterprise governance
Incident response automation
Operational best practices

💡 Key Takeaways

After completing this lesson, you should be able to:

Design enterprise event-driven architectures using Amazon EventBridge.
Build secure and scalable security automation workflows.
Implement SOAR capabilities using EventBridge, Lambda and Systems Manager.
Automate incident response while maintaining governance and auditability.
Integrate EventBridge with GuardDuty, Security Hub, AWS Config and Amazon Inspector.
Reduce Mean Time to Respond (MTTR) through consistent, event-driven security operations.

🚀 Next Lesson

➡️ Lesson 11 — Amazon Security Lake, Enterprise Security Data Lake, SIEM Integration & Centralised Security Analytics