Welcome to today's video presentation, where we will be exploring AI inventory within Cisco AI defense. This feature natively integrates with Amazon Web Services currently to provide enhanced security and operational insights while Azure and Google Cloud platform can.00:05Connectors are roadmap to be released soon. In this cyber capsule, we'll focus on integrating the AWS native connector for this deployment.00:20We'll begin by outlining today's agenda. 1st, we will provide an overview of AI visibility and discuss how the AI inventory feature enhances AWS integration. Next, we'll demonstrate how to configure AWS integration, the cloud formation stacks, and learn how to view AI inventory. Finally, we'll discuss best practices for maximizing.00:29Visibility and ensuring optimal security.00:49To start, let's define AI visibility. AI visibility offers an automated, consolidated discovery of AI assets, documents their software dependencies and supply chain lineage using multiple features. AI inventory leverages our new AWS native connector to directly discovery and inventory changes in AWS AI.00:53Assets such as bedrock and sagemaker models directly from AI defense. It identifies both sanctioned and unsanctioned AI workloads on public and private clouds. AI inventory leverages AWS Cloudtrail to detect immediate changes to AI assets by continuously reading cloud trail logs for event changes in real time. This comprehensive invent.01:13Inventory enables proactive security management, validation of AI assets.01:33And provides a clear understanding of asset usage and activity context. Step one, in AI defense, access the administration menu and select the integration sub menu. Here, we'll open the Amazon Web Services module by clicking on the manage button, then select the add integration button. This launch sequence will guide you through creating a cloud.01:38Information stack in AWS. In step one of the integration process, configure the connection by providing AWS details. Start with a display name relevant to your AWS organization or accounts. Choose between organizational unit for entire organizations or account for individual accounts.01:58In this example, we'll select the recommended organizational unit and enter the organizational unit ID. Then we'll select both capabilities below so that AI defense can discover assets in near real time read only, and by performing actions on discovered assets like red teaming, among other features. Cloud Trail needs to be configured on the AWS to leverage this new.02:17Their real time inventory changes to AI assets by reviewing the cloud trail logs.02:37Otherwise, scheduled scans typically occur once a day. In step two of the integration process, you'll deploy two IAM roles by creating a cloudformation stack. Click on the button launch cloudformation in AWS to begin defining the stack, which will create the two IAM roles and actions used by AI defense.02:41This will redirect you onto AWS cloudformation. The bottom three fields will be filled later by copying cloudformation stack outputs with specific arns from the two IAM roles created. We'll come back to this later.03:01Step two during the quick create stack setup in AWS, two significant roles are established. The inventory role and the action role, the inventory role, can perform AI model discovery, extended AI discovery, pulling cloud trail events, and AI runtime monitoring, which are read only functions. The action role can perform AI model.03:15Scanning and AI red teaming action functions. Most of these capabilities are enabled by default to simplify the quick create stack setup. Scroll down to the acknowledgment section to complete the process and create the stack. One optional step is template reuse where you can reuse your S3 buckets, trails, queues, and rules into cloud formation stack with map resources.03:35So in case you would like to where you can reuse your S3 buckets, trails and queues created.03:55Step two during the quick create stack setup in AWS, two significant roles are established, the inventory role and the action role. The discovery role can perform AI model discovery, extended AI discovery, pulling cloud trail events, and AI runtime monitoring, which are read only functions, the action role.04:02Can perform AI model scanning and AI red teaming action functions. Most of these capabilities are enabled by default to simplify the Quick Create stack setup. Scroll down to the acknowledgment section to complete the process and create the stack. The final step of the quick create stack is the acknowledgement section, which advises that this will create IA.04:21Resources needed for AI defense functionality on this AWS resource.04:41Check the acknowledgment box and then click the create stack button to initiate the creation of the cloud formation stack. This process is generally swift taking NO longer than 2 min. Following the steps on the slide, step one, you should see the status create complete for this cloud formation stack. This indicates that the stack was generated without issue.04:45Step two, navigate to the outputs tab, which will display the fields needed to copy and paste back into AI defense. Step three, carefully copy the values on the right of each associated roles individually to paste back an AI defense.05:06Here we'll copy two key values from the action role ARN and the discovery role ARN. We'll paste them in the correct fields in AI defense. After entering these values, click on submit to complete phase one of the AWS integration process. Your integration should show an active status with NO errors in the three capabilities.05:21Shown. Now let's see what AI inventory discovered.05:41When configuring your AWS infrastructure to support cloud trail capabilities, here's a list of services needed on AWS for near real time tracking of AI asset changes to immediately display on AI defense. Once configured, deploying the YAML template in the next step becomes a breeze to complete.05:47Step four, configure a dedicated S3 bucket used by AI defense for cloud trail logs, a bucket policy, and SNS event notifications that sends these events to the SQSQ as messages. We will use A general purpose bucket, a bucket name.06:06And a bucket policy, the bucket policy maps to our AWS account ID and S3 bucket while allowing the Cloudtrail service to put logs into it. Step five, cloud trail should be configured to ensure real time tracking for user actions, API calls, and service events in your AWS environment. This provide trouble.06:22Troubleshooting capabilities by tracking authentication and API sign ins from AI defense, particularly during onboarding. This also provides real time inventory changes to AI assets in your AWS environment to show up on AI defense. So if new agents are installed, you'll see this near real time to minimize shadow AI assets found in your AWS accounts.06:42We'll map this to our S3 bucket, focus on management events with read write capabilities for API activity.07:02Step six, we will create our second cloud formation stack where we'll 1st download the YAML template found in our AI defense user guide under integration section, and the Enable Cloud trail integration page then launch it to map services parameters with the asset inventory role extracted from the YAML template.07:10You can also reuse pre existing resources like SNS topic and SQSQ. So a new one isn't created, although this is optional. This is a quick process where we'll once again check the required acknowledgment to finish the stack. Step seven, we'll copy the SQSQ URL onto AI defense, following the.07:27Steps on the slide.07:47One, ensure that your second stack was created complete with NO errors. Two, go to the outputs tab where we'll find relevant values needed to copy. Three, next to the Q URL, copy the URL next to it to paste it back in AI defense. Paste the SQSQ URL from 2nd cloud formation stack.07:48Have the field marked SQSQ URL to guide AI defense to read cloud trail events. This should complete our AWS integration.08:08Step eight, to begin seeing AI assets on AI defense, navigate to AI assets from the left hand menu, then to AI inventory. This displays a comprehensive list including agents, skills, MCP servers, tools, models, and more.08:18AI inventory shows AI assets within their organization or account. Remember that AI inventory updates happen near real time for discovery or changes to AI assets in AWS. If any assets are assigned to an AI defense project, those resources will be only be seen by users or user groups assigned to that project.08:33This brings us to the conclusion of our demonstration on using AI inventory with AWS integration. As you continue exploring further integrations, you will unlock additional features and capabilities to safeguard AI assets against emerging threats. It's easier to protect what you have visibility into. We thank you for entrusting Cisco with your security needs and supporting our vision for.08:53Advanced to genic security.09:13
