Difference between revisions of "Amazon GuardDuty"
Jump to navigation
Jump to search
↑ https://aws.amazon.com/about-aws/whats-new/2017/11/announcing-amazon-guardduty-intelligent-threat-detection/
↑ https://aws.amazon.com/blogs/aws/new-using-amazon-guardduty-to-protect-your-s3-buckets/
| Line 8: | Line 8: | ||
* Homepage: https://aws.amazon.com/guardduty/ | * Homepage: https://aws.amazon.com/guardduty/ | ||
| − | + | == Detection examples == | |
| − | GuardDuty does not process requests to objects that you have made publicly accessible, but it does alert you when a bucket is made publicly accessible | + | * Compromised EC2 instances mining bitcoin |
| + | * An attacker scanning your web servers for known application vulnerabilities | ||
| + | * GuardDuty does not process requests to objects that you have made publicly accessible, but it does alert you when a bucket is made publicly accessible | ||
== Cost == | == Cost == | ||
Revision as of 15:06, 22 November 2021
wikipedia:Amazon GuardDuty (Nov 2017) [1] threat detection uses
- AWS CloudTrail logs:
- CloudTrail management events: activated by default, cannot be disabled.
- S3 protection: S3 data events (Jul 2020)[2]
- VPC Flow Logs
- DNS query logs
- Homepage: https://aws.amazon.com/guardduty/
Detection examples
- Compromised EC2 instances mining bitcoin
- An attacker scanning your web servers for known application vulnerabilities
- GuardDuty does not process requests to objects that you have made publicly accessible, but it does alert you when a bucket is made publicly accessible
Cost
Formats
- TXT
- STIX
- OTX_CSV
- ALIEN_VAULT
- PROOF_POINT
- FIRE_EYE
Related
- AWS CloudTrail management event analysis
- Delegated Administrator
- CrowdStrike
- AWS CloudTrail Insights
Activities
- https://aws.amazon.com/premiumsupport/knowledge-center/guardduty-cloudwatch-sns-rule/
- Read FAQ: https://aws.amazon.com/guardduty/faqs/
- Read https://stackoverflow.com/questions/tagged/amazon-guardduty?tab=Votes
See also
- Amazon GuardDuty:
aws guardduty[ list-detector | list-findings | create-detector ] - AWS GuardDuty, S3 protection, for EKS.
aws guardduty, Finding type, aws-guardduty-agent EKS addon, Runtine Monitoring - AWS security, AWS Security Hub, AWS CloudTrail, Amazon GuardDuty, Amazon Detective, AWS WAF, AWS Audit Manager, Amazon Fraud Detector, Cloudsploit, AWS Certified Security - Specialty, AWS Security Assurance Services, AWS GDPR, Amazon Inspector, AWS Network Firewall
Advertising:
