Amazon GuardDuty

Key concepts and terminologies

Here are some key concepts and terminologies related to Amazon GuardDuty:

• Detector: A GuardDuty detector is an instance of the GuardDuty service that continuously monitors and analyzes AWS resources and account activity for potential security threats in a region.

• Finding: A finding represents a security alert generated by GuardDuty when suspicious or malicious activity is detected within an AWS environment. Findings provide detailed information about the detected threat, including the affected AWS resources, the type of activity observed, and recommendations for remediation.

• Threat intelligence feeds: GuardDuty leverages threat intelligence feeds from AWS, third-party sources, and open-source feeds to enhance its detection capabilities. These feeds contain information about known malicious IP addresses, domains, and other indicators of compromise, which GuardDuty uses to identify potentially malicious activity.

• Severity: Each finding generated by GuardDuty is assigned a severity level based on the perceived impact and risk associated with the detected security threat. Severity levels range from low to high, with high-severity findings representing the most critical security issues that require immediate attention and remediation.

How GuardDuty works

Amazon GuardDuty works by continuously monitoring and analyzing activity within an AWS environment to identify potential security threats and vulnerabilities. It collects and analyzes data logs from various sources within an AWS account, including AWS CloudTrail logs, VPC Flow Logs, and DNS logs.

These logs provide detailed information about user activity, resource changes, network traffic, and DNS resolutions occurring within the AWS environment. It then uses a combination of machine learning algorithms, anomaly detection techniques, and threat intelligence feeds to analyze the collected data and identify suspicious or malicious activity. It looks for patterns and indicators of compromise (IOCs) associated with common attack vectors, such as unauthorized access attempts, compromised instances, malware infections, and data exfiltration.

When GuardDuty detects potentially malicious activity or security threats, it generates findings to provide detailed information about the detected threats, including the affected AWS resources, the type of activity observed, and the severity level of the threat. These findings are categorized based on the severity level, ranging from low to high, to prioritize remediation efforts.

Once security findings are identified, GuardDuty provides recommendations and remediation guidance to help organizations address security threats effectively. It enables security teams to investigate incidents, mitigate risks, and implement proactive security measures to improve the overall security posture of our AWS environments.

A common use case of GuardDuty is to protect EC2 instances and containers used for Bitcoin mining. It monitors the account for suspicious activity, such as unauthorized deployments or unusual API calls. It can also export the findings to a S3 bucket that can be helpful for further analysis.

GuardDuty protections

GuardDuty monitors potential security threats for other AWS services, such as EKS, Lambda, EC2, EBS, ECS, RDS, and S3. Let’s look at how these resources are being protected against malicious activities:

• EKS protection: GuardDuty analyzes the EKS Audit Log for a sequence of events from users to protect against any suspicious activities in EKS clusters.

• Lambda protection: GuardDuty scans VPC logs to monitor any suspicious piece of code in the Lambda function.

• Malware protection: GuardDuty scans the EBS volumes that are attached to EC2 instances for the presence of any potential malware.

• RDS protection: GuardDuty helps protect the Aurora databases against potential login access threats.

• Runtime monitoring: GuardDuty helps to observe operating system-level networking for EKS, ECS, EC2 instances, and AWS Fargate.

• S3 protection: GuardDuty monitors AWS CloudTrail data events for the Amazon S3 to identify potential threats to the objects in S3 buckets.