Description:
Amazon GuardDuty is a continuous security monitoring service that analyses and processes the following data sources: VPC Flow Logs, AWS CloudTrail event logs, and DNS logs. It is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts, workloads, and data stored in Amazon S3. The service uses machine learning, anomaly detection, and integrated threat intelligence to identify and prioritize potential threats.
Rationale:
GuardDuty can detect compromised EC2 instances serving malware or mining bitcoin. It also monitors AWS account access behavior for signs of compromise, such as unauthorized infrastructure deployments, instances deployed in a Region that has never been used, or unusual API calls, like a password policy change to reduce password strength.
Impact:
Enabling GuardDuty can generate findings of unauthorized or unusual activity even in Regions that you are not actively using. This also allows GuardDuty to monitor AWS CloudTrail events for global AWS services such as IAM.
Default Value:
By default, GuardDuty is not enabled on your AWS Infrastructure.
Pre-Requisite:
Amazon GuardDuty is Region dependent and must be enabled in all regions where you have resources, to monitor AWS CloudTrail events for global AWS Services like IAM.
Remediation:
Test Plan:
Sign in to the AWS Management Console.
Navigate to AWS GuardDuty home page at https://console.aws.amazon.com/guardduty.
In the left navigation panel, under Findings
If you find any findings in the current page
Then follow the implementation steps
Using AWS CLI:
aws guardduty list-findings --detector-id 12abc34d567e8fa901bc2d34eexample
Implementation Steps:
Sign in to the AWS Management Console.
Navigate to AWS GuardDuty home page at https://console.aws.amazon.com/guardduty.
In the left navigation panel, under Findings,
Click on the GuardDuty finding that you want to examine to expand the finding details panel.
Analyze the selected AWS GuardDuty findings
You can find the defect in which of your account by account no. and severity level and the remediation steps.
Based on the information returned at the previous step you can analyze the selected finding and make a plan to implement the recommended fix (see Remediation/Resolution section).
Repeat steps no. 4 – 6 to check and analyze other Amazon GuardDuty findings available in the current region.
Change the AWS region from the navigation bar and repeat the process for all regions
Using AWS CLI:
Based on the information returned at the previous step you can analyze the selected finding and make a plan to implement the recommended fix (see Remediation/Resolution section).
aws guardduty get-findings --detector-id 12abc34d567e8fa901bc2d34eexample --finding-id 1ab92989eaf0e742df4a014d5example
