Does anyone use AWS GuardDuty?

JDMurray · September 2019

I'm looking for opinions from first-hand experience with AWS GuardDuty.

scasc · September 2019

An excellent tool used where I’m currently doing some consultancy work. Used to facilitate threat intel from your VPC flow logs, DNS logs and Cloudwatch. Anything you were particularly keen in finding out.

JDMurray · September 2019

Right now I'm interested in all the log sources that GD ingests. I assume it does CloudTrail logs as well? Does it also support logs from some non-AWS software?

scasc · September 2019

Sources at the moment are Cloud Trail logs, DNS and Flow logs - interface, subnet or instance. Does not at the moment, as far as I know, support other sources. Though you could through it’s API send logs to a SIEM for example if you needed multiple log sources.

JDMurray · September 2019

I'm hoping GD can be (one day) customized to use its rules engine to read custom application logs. I can see GD supporting a Lambda-like feature that would use customer-supplied regex's to read custom log files for standard data (src/dst IP, src/dst port, protocol, etc.) and free-form information (DNS TXT record) and process it using GD's rules. I guess I'm looking for a simpler and cheaper alternative to Splunk inside of AWS.

scasc · September 2019

haha - if only! At the moment limited as the objective is to do continuous monitoring against unauthorised use of your AWS platform (e.g. Bit-mining, SSH brute forcing, DNS ex filtration etc). Only place I have seen supplied Regex's is Athena - but that is from S3 bucket where you query the logs fed here (via SQL) for things like IP addresses, time etc.

You could also use Config to stipulate a policy that will then connect to Lambda to run your serverless rules if there is non compliance to that policy.

JDMurray · October 2019

Hey, thanks for the pointer to AWS Athena, Config, and Glue. I'll ponder those for my needs.

scasc · October 2019

No worries, best of luck.

Does anyone use AWS GuardDuty?

Comments