Configure Amazon GuardDuty monitoring

Amazon GuardDuty® is a threat detection service that continuously monitors your AWS accounts and resources for unexpected and potentially malicious activity in your AWS environment. To integrate this service with Arctic Wolf® Cloud Detection and Response, configure Amazon GuardDuty to forward its findings to Arctic Wolf. Your Concierge Security® Team (CST) analyzes these findings, eliminates false positives, and provides guidance within the context of your security posture.

Requirements

• An AWS user or Identity and Access Management (IAM) role with AdministratorAccess or an equivalent IAM policy.

• Access to the AWS Management Console.

Before you begin

• Previously, an Arctic Wolf CloudFormation stack was required for GuardDuty configuration. If you configured GuardDuty using that stack, you must remove the stack, as described in Deprecated stacks in Update AWS CloudFormation Stacks, and then follow the steps here to enable GuardDuty.

• Confirm that your AWS account credentials are Healthy. See Provide AWS Credentials to Arctic Wolf.

• Contact your CST to confirm that Arctic Wolf is receiving your CloudTrail events. See Configure AWS CloudTrail Event Monitoring.

Steps

1. Enable GuardDuty monitoring
2. Enable S3 protection
3. Enable EKS protection
4. Configure GuardDuty to write logs
5. Configure GuardDuty to export logs
6. Verify GuardDuty configuration

Step 1: Enable GuardDuty monitoring

If you have:

• A single AWS account — Proceed to Enable GuardDuty monitoring for a single account.

• Multiple AWS accounts that you manage with AWS Organizations — Proceed to Enable GuardDuty monitoring for multiple accounts with AWS Organizations.

  Note: Arctic Wolf recommends using AWS Organizations and leveraging a delegated administrator account, since this configuration automatically enables GuardDuty for all member accounts.

• Multiple AWS accounts and do not use AWS Organizations — Proceed to Enable GuardDuty monitoring for multiple account without AWS Organizations.

Enable GuardDuty monitoring for a single account

1. Review Supported AWS regions and identify the region that you want Arctic Wolf to monitor.

2. Sign in to the GuardDuty console.

   The console opens to the Findings page if GuardDuty is enabled.

3. If the Findings page does not appear, complete these steps to enable GuardDuty in your preferred AWS region:

   1. Click Get Started.

   2. Click Enable GuardDuty.

   Tip: See Enable GuardDuty in the AWS documentation for more information about enabling GuardDuty.

4. Proceed to Enable S3 Protection.

Enable GuardDuty monitoring for multiple accounts with AWS Organizations

1. If you use AWS Organizations:

   • Without AWS Control Tower — Follow the three-step process to designate a delegated GuardDuty administrator account in Managing GuardDuty accounts with AWS Organizations.

   • With AWS Control Tower — Follow the three-step process in Managing GuardDuty accounts with AWS Organizations to delegate your default audit account as the GuardDuty administrator in all regions of your Control Tower managed organization.

2. Sign in to the GuardDuty console with your delegated administrator account.

3. In the navigation menu, click Settings > Accounts.

4. If the Auto-enable is OFF option appears, select that option to automatically enable GuardDuty for new member accounts when they join your organization.

5. Proceed to Enable S3 Protection.

Enable GuardDuty monitoring for multiple account without AWS Organizations

For each account you want Arctic Wolf to monitor:

1. Sign in to the GuardDuty console.
2. If the Findings page does not appear:
   1. Click Get Started.
   2. Click Enable GuardDuty.
3. Proceed to Enable S3 Protection.

Step 2: Enable S3 protection

1. Sign in to the GuardDuty console.

2. In the navigation menu, click Settings > S3 Protection.

3. Confirm that S3 Protection is enabled for this account.

Step 3: Enable EKS protection

Enable Elastic Kubernetes Service (EKS) protection for the GuardDuty accounts that you want Arctic Wolf to monitor.

If you have:

• One account that Arctic Wolf is monitoring — Proceed to Enable EKS protection for a single account.

• If you have multiple accounts that an administrator manages — Proceed to Enable EKS protection for multiple accounts.

Enable EKS protection for a single account

1. Sign in to the GuardDuty console.

2. In the navigation menu, click Settings > Kubernetes protection.

3. If you see a notice similar to "Kubernetes Audit Logs Monitoring is not enabled for this account," click Enable to enable EKS protection.

4. Proceed to Configure GuardDuty to write logs.

Enable EKS protection for multiple accounts

1. As an administrator, sign in to the GuardDuty console.

2. In the navigation menu, click Settings > Kubernetes protection.

3. To enable automatic EKS protection for new and existing member accounts, click Enable all.

4. Click Update Settings.

5. Proceed to Configure GuardDuty to write logs.

Step 4: Configure GuardDuty to write logs

How you configure GuardDuty to export logs depends on whether or not you configured Cloudtrail event monitoring in Configure AWS Cloudtrail Event Monitoring with the same account you assigned as your delegated GuardDuty administrator in the previous steps.

To check if you used the same account or a different account for these configurations:

1. Compare the 12-digit Account ID value in the GuardDuty console to the AWS Account ID value on the Connected Accounts page in the Arctic Wolf Unified Portal.

2. If the account numbers:

   • Match — Proceed to Write GuardDuty logs to the same account.

   • Do not match — Proceed to Write GuardDuty logs to a different account.

Write GuardDuty logs to the same account

To write GuardDuty logs to a local Arctic Wolf S3 bucket that is in the same AWS account:

1. Sign in to the GuardDuty console.

2. In the navigation menu, click Settings.

3. In the Findings export options setting, under S3 Bucket, click Configure now.

4. Click Existing bucket in your account.

5. Under Choose a bucket, select the bucket with a name similar to awn-logs-bucket-<account-id>-<region>, where <account-id> is the 12-digit ID number of your current AWS account and <region> is the region of the S3 bucket.

6. Leave the Log file prefix blank.

7. Under KMS Encryption, click Choose a key from your account.

8. Under Key Alias, select AWNKMSKey.

9. Click Save.

10. Proceed to Configure GuardDuty to export logs.

Write GuardDuty logs to a different account

If you:

• Use AWS Control Tower — Proceed to Add the bucket policy for AWS Control Tower to add the necessary bucket policy to the awn-logs-bucket-<account-id>-<region> bucket.
• Do not use AWS Control Tower — Proceed to Write GuardDuty logs

Step 1: Add the bucket policy for AWS Control Tower

For most environments, the base stack adds the permissions needed for the newly created log bucket. However, AWS Control Tower guardrails prevent the addition of the necessary policy.

1. Sign in to the AWS Management Console.

2. Open the Amazon S3 Console and select the awn-logs-bucket-<account-id>-<region> bucket, where <account-id> is your 12-digit AWS account number and <region> is the region of the bucket.

3. Click the Permissions tab.

4. In the Bucket policy section, click Edit.

5. Copy this policy and paste it into the Policy field, replacing <bucket-name> with the name of your bucket:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "GuardDutyPutObject",
               "Effect": "Allow",
               "Principal": {
                   "Service": "guardduty.amazonaws.com"
               },
               "Action": "s3:PutObject",
               "Resource": "arn:aws:s3:::<bucket-name>/*"
           },
           {
               "Sid": "GuardDutyGetBucketLocation",
               "Effect": "Allow",
               "Principal": {
                   "Service": "guardduty.amazonaws.com"
               },
               "Action": "s3:GetBucketLocation",
               "Resource": "arn:aws:s3:::<bucket-name>"
           }
       ]
   }

6. Click Save changes.

7. Proceed to Write GuardDuty Logs

Step 2: Write GuardDuty logs

To write GuardDuty logs to a different AWS account that Arctic Wolf already monitors, for example, if you use AWS Organizations or AWS Control Tower:

1. Sign in to the AWS account that Arctic Wolf already monitors in the Amazon Management Console, and then click Services > Key Management Service.

2. In the KMS console navigation menu, click Customer managed keys.

3. Copy the Key ID value for the AWNKMSKey key, for use in a later step.

4. From the Services menu, click S3.

5. In the Buckets list, select the account bucket name, similar to awn-logs-bucket-<account-id>-<region>, where the <account-id> is the 12-digit ID of the AWS account that Arctic Wolf already monitors and the <region> is the region of the S3 bucket.

   Tip: This bucket was created when you created your Arctic Wolf CloudFormation stack in Configuring AWS CloudTrail Event Monitoring.

6. Click the Properties tab, and then copy the Amazon Resource Name (ARN) value, for use in a later step.

7. In the Services menu, click GuardDuty to open the GuardDuty console.

8. In the GuardDuty console navigation menu, click Settings.

9. In the Findings export options section, under S3 Bucket, click Configure now.

10. Click Existing bucket in another account.

11. Under Bucket ARN, enter the bucket ARN that you copied.

12. Under Key ARN, enter the AWNKMSKey Key ID value that you copied.

13. Click Save.

14. Repeat the above steps for any other region that you want to forward GuardDuty findings from.

15. Proceed to Configure GuardDuty to export logs.

Step 5: Configure GuardDuty to export logs

To ensure that Arctic Wolf can send alerts in a timely manner:

1. Sign in to the GuardDuty console.
2. In the navigation menu, click Settings.
3. In the Findings export options section, select Frequency for updated findings, and then select Update CWE and S3 every 15 minutes.
4. Click Save.

Step 6: Verify GuardDuty configuration

To verify that the GuardDuty configuration works, trigger sample GuardDuty findings to write in your account:

1. Sign in to the GuardDuty console.
2. In the navigation menu, click Settings.
3. On the Settings page, under Sample findings, click Generate sample findings.
4. In the navigation menu, click Findings.
5. The sample findings are displayed on the Current findings page with a "SAMPLE" prefix.
6. Contact your CST to confirm that Arctic Wolf received these sample findings.

Next steps

Proceed to Configure AWS S3 Bucket Log Monitoring to send logs to Arctic Wolf.

For all AWS configuration options, see Configure AWS Account Monitoring.