Does anyone use AWS GuardDuty?

JDMurray

I'm looking for opinions from first-hand experience with AWS GuardDuty.

scasc

An excellent tool used where I’m currently doing some consultancy work. Used to facilitate threat intel from your VPC flow logs, DNS logs and Cloudwatch. Anything you were particularly keen in finding out.

JDMurray

Right now I'm interested in all the log sources that GD ingests. I assume it does CloudTrail logs as well? Does it also support logs from some non-AWS software?

scasc

Sources at the moment are Cloud Trail logs, DNS and Flow logs - interface, subnet or instance. Does not at the moment, as far as I know, support other sources. Though you could through it’s API send logs to a SIEM for example if you needed multiple log sources. 

JDMurray

I'm hoping GD can be (one day) customized to use its rules engine to read custom application logs. I can see GD supporting a Lambda-like feature that would use customer-supplied regex's to read custom log files for standard data (src/dst IP, src/dst port, protocol, etc.) and free-form information (DNS TXT record) and process it using GD's rules. I guess I'm looking for a simpler and cheaper alternative to Splunk inside of AWS.

scasc

haha - if only! At the moment limited as the objective is to do continuous monitoring against unauthorised use of your AWS platform (e.g. Bit-mining, SSH brute forcing, DNS ex filtration etc). Only place I have seen supplied Regex's is Athena - but that is from S3 bucket where you query the logs fed here (via SQL) for things like IP addresses, time etc. 

You could also use Config to stipulate a policy that will then connect to Lambda to run your serverless rules if there is non compliance to that policy.

JDMurray

Hey, thanks for the pointer to AWS Athena, Config, and Glue. I'll ponder those for my needs.

scasc

No worries, best of luck.