Skip to content
Hannctl.
Field Notes

E15 · Woori FIS · Feb 2026 – Oct 2026

Alerts from many accounts on one screen

  • GuardDuty
  • Security Hub
  • Splunk
  • SIEM
Account AAccount BAccount CGuardDutyFinds threatsSecurity HubOne formatSplunk SIEMUnified monitoring
Every alert lands on one Splunk SIEM screen.

In one line

I connected GuardDuty, Security Hub, and Splunk SIEM to monitor security events across multiple AWS accounts in one place.

Background

  • GuardDuty: the AWS threat detection service. It finds threats such as unusual traffic or suspected credential theft.
  • Security Hub: collects results from several security services in one format.
  • SIEM: a system that gathers security logs from many systems for analysis. Here, that is Splunk.

What I did

I connected the three to monitor security events across multiple AWS accounts in one place.

Open to work · Cloud infrastructure and security