GuardDuty

What is Amazon GuardDuty?

Amazon GuardDuty is a managed threat detection service in AWS that continuously monitors your cloud environment for anomalies, malicious activity, and known threats. It analyzes data sources such as CloudTrail logs, VPC Flow Logs, and DNS logs to identify suspicious behaviors, unauthorized access attempts, and compromised resources. GuardDuty also uses machine learning and threat intelligence feeds to provide contextual alerts called findings.

GuardDuty plays a key role in AWS security by providing actionable alerts, helping threat hunters detect and respond to threats efficiently.

How GuardDuty Works

1. Data Sources Used by GuardDuty:

   • CloudTrail Management Events: Detects unusual API activity.

   • CloudTrail S3 Data Events: Monitors access to S3 buckets for unauthorized access.

   • VPC Flow Logs: Analyzes network traffic for suspicious connections.

   • DNS Logs: Identifies attempts to resolve malicious domains.

2. Threat Detection Techniques:

   • Anomaly Detection: Detects deviations from normal behavior (e.g., unusual IP activity).

   • Threat Intelligence: Uses feeds from AWS and external providers to detect known malicious IPs and domains.

   • Machine Learning Models: Identifies patterns of attacks like brute force attempts and data exfiltration.

3. GuardDuty Findings: Each finding includes:

   • Resource involved: The EC2 instance, IAM user, or service targeted.

   • Severity: A score between 0 and 8 (Low, Medium, or High).

   • Description: A detailed message about the detected issue.

Log Record Structure of GuardDuty Findings

Each GuardDuty finding provides detailed information about the anomalous event. Here’s an example of the JSON structure for a finding:

{
  "id": "12abc345-678d-901e-2345-678f901g2h34",
  "severity": 7.5,
  "resource": {
    "instanceDetails": {
      "instanceId": "i-0123456789abcdef0",
      "tags": [{"key": "Name", "value": "web-server"}]
    }
  },
  "type": "UnauthorizedAccess:EC2/SSHBruteForce",
  "description": "An SSH brute force attack was detected on an EC2 instance.",
  "service": {
    "detectorId": "abc12345-6789-def0-1234-567890abcdef",
    "action": {
      "actionType": "NETWORK_CONNECTION",
      "networkConnectionAction": {
        "remoteIpDetails": {
          "ipAddressV4": "203.0.113.25",
          "organization": {"asn": "AS12345"}
        }
      }
    }
  }
}