Threat Detection and Security Findings

What it is

Security monitoring finds threats and weaknesses early. AWS offers several detection services, each looking at a different data source, plus a hub that collects their findings in one place.

For a multi account organization the design goal is the same for every service: turn it on everywhere, send findings to one security account, and route them to people or automation.

How it works

The detection services

For its core data sources GuardDuty needs no agent and reads these logs independently, so you do not have to enable the logs yourself. Optional protection plans add coverage for S3 data events, EKS audit logs, runtime monitoring, malware scanning of EBS volumes and RDS login activity.

Detective builds a behavior graph over time, so an analyst can pivot from a finding to the related IP address, user or instance and see what else it did.

AWS Security Hub

Security Hub collects findings from AWS services and partner products and normalizes them to one format. It also runs automated checks against security standards, such as AWS Foundational Security Best Practices and the CIS AWS Foundations Benchmark, and computes a score. The checks rely on AWS Config recording being on.

Organization wide setup

Each service supports Organizations integration. A delegated administrator account, often the security tooling account, enables the service, auto enables new member accounts and sees all findings. A Security Hub administrator also aggregates across Regions by choosing a home Region.

Use CloudFormation StackSets or Control Tower to enable the required services and settings in new accounts automatically, so there is no gap on day one.

Routing findings

All of these services publish findings to EventBridge. A rule can filter by severity or type and call a target.

{
  "source": ["aws.securityhub"],
  "detail-type": ["Security Hub Findings - Imported"],
  "detail": {"findings": {"Severity": {"Label": ["CRITICAL", "HIGH"]}}}
}

Targets include an SNS topic that notifies the security team, a Lambda function or Automation runbook that contains the issue, and a ticketing integration. Suppression rules, trusted IP lists and threat lists tune GuardDuty to reduce noise.

Alarms from log data

Not every signal is a managed finding. A CloudTrail trail delivered to CloudWatch Logs allows metric filters and alarms for events such as use of the root user.

{ $.userIdentity.type = "Root" && $.userIdentity.invokedBy NOT EXISTS && $.eventType != "AwsServiceEvent" }

Pair such a filter with a metric, an alarm and an SNS topic, so the security team is told whenever the root user signs in or changes critical settings.

Network and DNS visibility

VPC Flow Logs, Route 53 Resolver query logs and load balancer logs add network evidence for investigation. Send them to a central bucket or log group for correlation.

Choosing