AWS AppFabric
Connect SaaS applications
Connects business SaaS applications (Slack, Zoom, Salesforce, Microsoft 365…) and normalizes their audit logs into OCSF format to send to security tools such as Security Lake or a SIEM.
- Cost$$ Medium
- Difficulty●●●●●
- Costs money when idle?Yes
- Serverless
Think of it asLike an interpreter who collects the entry logs from many different buildings and rewrites them in the same format for the security office.
When to use it
✓ Use it when
Your security team needs a centralized view of user activity across many SaaS applications.
✗ Avoid it when
Only need to sync business data between SaaS and AWS → AppFlow; logs from AWS services themselves → CloudTrail / Security Lake.
Common uses
- Collect SaaS audit logs into Security Lake
- Detect unusual sign-ins on SaaS applications
- Normalize logs to OCSF for a SIEM
What does it cost?
- Pricing model: Billed per unique user per connected application each month.
