GuardDuty

Overview

GuardDuty is a continuous security monitoring service that analyses and processes the following Data sources: VPC Flow Logs, CloudTrail logs, and DNS logs.
It uses threat intelligence feeds, such as lists of malicious IP addresses and domains, and machine learning to identify unexpected and potentially unauthorized and malicious activity within your AWS environment.
- This can include issues like escalations of privileges, uses of exposed credentials, or communication with malicious IP addresses, or domains.
  - For example, GuardDuty can detect compromised EC2 instances serving malware or mining bitcoin.
You can also invite other accounts to enable GuardDuty and become associated with your AWS account in GuardDuty.
- If your invitations are accepted, your account is designated as the administrator GuardDuty account, and the added accounts become your member accounts.
If you use AWS DNS resolvers for your EC2 instances (the default setting), then GuardDuty can access and process your request and response DNS logs through the internal AWS DNS resolvers.
If you are using a 3rd party DNS resolver, for example, OpenDNS or GoogleDNS, or if you set up your own DNS resolvers, then GuardDuty cannot access and process data from this data source.

GuardDuty findings

A GuardDuty finding represents a potential security issue detected within your network.
GuardDuty generates a finding whenever it detects unexpected and potentially malicious activity in your AWS environment.

Suppression rules

A suppression rule is a set of criteria used to filter findings by automatically archiving new findings that match the specified criteria.
Suppression rules can be used to filter low-value findings, false positive findings, or threats you do not intend to act on, to make it easier to recognize the security threats with the most impact to your environment.

Trusted IP lists and threat lists

You can customize the monitoring scope by configuring GuardDuty to also use your own trusted IP lists and threat lists.
Trusted IP lists consist of IP addresses that you have trusted for secure communication with your AWS infrastructure and applications.
In multi-account environments only users from GuardDuty administrator accounts can upload and manage trusted IP lists and threat lists.
Threat lists consist of known malicious IP addresses.
- GuardDuty generates findings based on threat lists.

PreviousHow do you report abuse of AWS resources?NextPenetration Testing

Last updated 4 years ago

Was this helpful?

Overview

GuardDuty is a continuous security monitoring service that analyses and processes the following Data sources: VPC Flow Logs, CloudTrail logs, and DNS logs.

It uses threat intelligence feeds, such as lists of malicious IP addresses and domains, and machine learning to identify unexpected and potentially unauthorized and malicious activity within your AWS environment.

This can include issues like escalations of privileges, uses of exposed credentials, or communication with malicious IP addresses, or domains.
- For example, GuardDuty can detect compromised EC2 instances serving malware or mining bitcoin.

You can also invite other accounts to enable GuardDuty and become associated with your AWS account in GuardDuty.

If your invitations are accepted, your account is designated as the administrator GuardDuty account, and the added accounts become your member accounts.

If you use AWS DNS resolvers for your EC2 instances (the default setting), then GuardDuty can access and process your request and response DNS logs through the internal AWS DNS resolvers.

If you are using a 3rd party DNS resolver, for example, OpenDNS or GoogleDNS, or if you set up your own DNS resolvers, then GuardDuty cannot access and process data from this data source.

Suppression rules

A suppression rule is a set of criteria used to filter findings by automatically archiving new findings that match the specified criteria.

Suppression rules can be used to filter low-value findings, false positive findings, or threats you do not intend to act on, to make it easier to recognize the security threats with the most impact to your environment.

Trusted IP lists and threat lists

You can customize the monitoring scope by configuring GuardDuty to also use your own trusted IP lists and threat lists.

Trusted IP lists consist of IP addresses that you have trusted for secure communication with your AWS infrastructure and applications.

In multi-account environments only users from GuardDuty administrator accounts can upload and manage trusted IP lists and threat lists.

Threat lists consist of known malicious IP addresses.

GuardDuty generates findings based on threat lists.