GuardDuty and Detective

What it is

Amazon GuardDuty is a managed threat detection service. It analyses several AWS data sources with threat intelligence, anomaly detection and machine learning, and produces findings that describe suspicious activity such as a compromised instance or misused credentials.

Amazon Detective is a different tool for a different moment. GuardDuty answers "is something wrong?", and Detective helps you answer "what happened, who did it and how far did it spread?".

How it works

Data sources

GuardDuty reads its own copy of the foundational sources, so you do not need to enable flow logs or a trail for it to work. The foundational sources are CloudTrail management events, VPC (Virtual Private Cloud) flow logs and DNS query logs from the VPC resolver.

Optional protection plans add more coverage and are turned on separately.

Reading a finding

A finding has a type, a severity and the affected resource. The type name follows a pattern of threat purpose, resource and detail, for example UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS. That one means credentials from an EC2 instance role were used from an address outside AWS.

Severity is a numeric score that maps to levels such as Low, Medium and High. Use the numeric severity in EventBridge patterns to page only for high findings.

Tuning

• Suppression rules automatically archive findings that match criteria you define. The findings are still recorded, but they are not shown as current.
• Trusted IP lists name addresses that are safe, so GuardDuty does not alert on them for some finding types.
• Threat lists name addresses that are known to be bad, so activity involving them raises findings.
• Lists are uploaded as files in S3 and are Regional, so repeat them in each Region where you use them.

Organization setup

Enable GuardDuty in every Region, because findings are Regional and an attacker will use the Region you forgot. Use AWS Organizations to designate a delegated administrator account, which then enables GuardDuty for member accounts automatically, including new ones.

# AWS CLI, run in the Organizations management account
aws guardduty enable-organization-admin-account \
  --admin-account-id 222233334444

# AWS CLI, run in the delegated administrator account
aws guardduty update-organization-configuration \
  --detector-id 12abc34d567e8fa901bc2d34e56789f0 \
  --auto-enable-organization-members ALL

The administrator account sees member findings and can export them. Exporting findings to S3 requires an S3 bucket and a KMS key whose policies allow GuardDuty, and the export is the way to keep findings beyond the retention period in the service.

What GuardDuty does not do

GuardDuty does not block traffic, change configuration or fix anything. It reports, and you connect the report to a response, as the incident response chapter explains.

Amazon Detective

Detective collects CloudTrail logs, VPC flow logs, GuardDuty findings and other sources into a behavior graph. It then shows timelines, geolocation of sign ins, and resource relationships for a finding or an entity such as a role, user or IP address.

Use Detective to answer scoping questions: which other resources did this role touch, did the same address appear in other accounts, and when did the behaviour start. Pivot into Detective straight from a GuardDuty finding in the console.