Configure Amazon GuardDuty for Arctic Wolf monitoring

You can configure Amazon GuardDuty® to send the necessary logs to Arctic Wolf® for security monitoring.

Amazon GuardDuty is a threat detection service that continuously monitors your AWS accounts and resources for unexpected and potentially malicious activity in your AWS environment. To integrate this service with Arctic Wolf Cloud Detection and Response, configure Amazon GuardDuty to forward its findings to Arctic Wolf. Your Concierge Security® Team (CST) analyzes these findings, eliminates false positives, and provides guidance within the context of your security posture.

Requirements

• An AWS user or Identity and Access Management (IAM) role with AdministratorAccess or an equivalent IAM policy
• Access to the AWS Management Console

Before you begin

• Make sure your AWS account credentials are Healthy.

  For more information, see Provide AWS Credentials to Arctic Wolf.

• Contact your CST® to verify that Arctic Wolf is receiving your CloudTrail events.

  For more information, see Configure AWS CloudTrail Event Monitoring.

Steps

For each region that you want to forward GuardDuty findings from, complete these steps:

1. Determine your AWS deployment scenario.
2. Configure GuardDuty.
3. Enable S3 protection.
4. Enable EKS protection.

Step 1: Determine your AWS deployment scenario

Configure your Amazon GuardDuty monitoring based on your deployment scenario. If you have:

• A single account — Configure GuardDuty with a single account.
• Multiple single accounts without AWS Organizations — Configure GuardDuty with a single account for each account.
• Multiple accounts with AWS Organizations:
  • A delegated administrator account is configured:
    • Exporting to S3 is configured — Contact your CST to discuss your configuration.
    • Exporting to S3 is not configured — Configure GuardDuty with multiple accounts with AWS Organizations and a delegated administrator account.
  • A delegated administrator account is not configured — Configure GuardDuty with a single account for each account.
• Multiple accounts with AWS Control Tower:
  • Exporting to S3 is configured — Contact your CST to discuss your configuration.
  • Exporting to S3 is not configured — Configure GuardDuty with AWS Control Tower.

Step 2: Configure GuardDuty

You can configure GuardDuty based on your deployment scenario.

Configure GuardDuty with a single account

You can configure GuardDuty for a single account if you have:

• A single account
• Multiple single accounts without AWS Organizations
• Multiple accounts with AWS Organizations and a delegated administrator account is not configured.

Steps

1. Create the base stack.
2. Configure findings for each region that has GuardDuty enabled.
3. Launch the S3 CloudFormation stack.

Step 1: Create the base stack

1. Complete Configure CloudTrail monitoring with no existing trails.

2. When the stack has a status of CREATE_COMPLETE, navigate to CloudTrail.

3. Select the newly created trail, and then delete it.

   The trail was required to deploy GuardDuty configurations, and it is no longer needed.

Step 2: Configure findings for each region that has GuardDuty enabled

1. Sign in to the GuardDuty console.
2. In the navigation menu, click Settings.
3. In the Findings export options section, in the Frequency section, click Edit, and then select 15 minutes.
4. Click Save changes.
5. In the Findings export options section, in the S3 Bucket section, click Configure now.
6. In the S3 bucket ARN section, enter the ARN of the bucket with a similar name to awn-logs-bucket-<account-id>-<region>, where <account-id> is the 12-digit ID number of your current AWS account and <region> is the region of the S3 bucket.
7. In the KMS Encryption section, enter the ARN of the AWNKMSKey.
8. Click Save.

Step 3: Launch the S3 CloudFormation stack

1. On the CloudFormation page, click Create stack > With new resources (standard).

2. On the Create Stack page, configure these settings:

   • Prepare template — Select the Template is ready option.
   • Template Source — Select the Amazon S3 URL option.

3. In a new browser tab, go to the MDR Dashboard, copy the S3 Logs stack URL, and then paste it into the Amazon S3 URL field.

4. CLick Next.

5. In the Specify stack details section, in the Stack name field, enter a name for the S3 log forwarding stack. For example, ArcticWolf-S3LogForward.

   Note: This name helps you identify resources that are created to collect and forward security events to Arctic Wolf. Make sure it is unique.

6. In the Parameters section, in the bucketName field, enter the name of the S3 bucket that will be used to save logs.

7. If the bucket is used for:

   • Storing security logs only — Keep the prefixPath field empty.

   • Multiple purposes — In the prefixPath field, enter a prefix to monitor for new objects. For example,<myservice>/logs.

     To lower AWS costs, only applicable data is forwarded to Arctic Wolf.

     Note: When entering the prefixPath value, do not include a trailing slash, /.

8. If the logs use encryption that is different from the AWNKMSKey, enter the ARN of the KMS key in the kmsKey field.

   Note: If the KMS key is located in a different account from the account you are deploying the CloudFormation stack, contact your CST® for configuration guidance.

9. Click Next.

   You are redirected to the Configure stack options page. Do not make changes on this page.

10. Click Next.

11. On the Review page, read the Capabilities section.

12. Select all checkboxes.

    Note: The stack is not created correctly if you do not select all checkboxes.

13. Click Submit.

    CloudFormation provides a preview of stack changes, which are prefixed with the Stack name property. This process usually takes 5 to 10 minutes to complete.

14. Wait until the base stack and all nested stacks have a status of CREATE_COMPLETE to make sure that the CloudFormation stacks were successfully created. Do not proceed to the next step until this is complete.

15. Contact your CST® to verify that Arctic Wolf is processing logs from your S3 bucket.

Configure GuardDuty with multiple accounts with AWS Organizations and a delegated administrator account

You can configure GuardDuty for multiple accounts with AWS Organizations if you have a delegated administrator account and exporting to S3 is not configured.

Steps

1. Determine your GuardDuty delegated administrator account.
2. Create the base stack.
3. Configure findings for each region that has GuardDuty enabled.
4. Launch the S3 CloudFormation stack.

Step 1: Determine your GuardDuty delegated administrator account

1. Sign in to the GuardDuty console.
2. In the navigation menu, click Accounts.
3. If you have a delegated administrator account, a banner displays with Your account is being managed by your GuardDuty administrator account with ID #. Use this account to continue with configuration.

Step 2: Create the base stack

1. Complete Configure CloudTrail monitoring with no existing trails.

2. When the stack has a status of CREATE_COMPLETE, navigate to CloudTrail.

3. Select the newly created trail, and then delete it.

   The trail was required to deploy GuardDuty configurations, and it is no longer needed.

Step 3: Configure findings for each region that has GuardDuty enabled

1. Sign in to the GuardDuty console.
2. In the navigation menu, click Settings.
3. In the Findings export options section, in the Frequency section, click Edit, and then select 15 minutes.
4. Click Save changes.
5. In the Findings export options section, in the S3 Bucket section, click Configure now.
6. In the S3 bucket ARN section, enter the ARN of the bucket with a similar name to awn-logs-bucket-<account-id>-<region>, where <account-id> is the 12-digit ID number of your current AWS account and <region> is the region of the S3 bucket.
7. In the KMS Encryption section, enter the ARN of the AWNKMSKey.
8. Click Save.

Step 4: Launch the S3 CloudFormation stack

1. On the CloudFormation page, click Create stack > With new resources (standard).

2. On the Create Stack page, configure these settings:

   • Prepare template — Select the Template is ready option.
   • Template Source — Select the Amazon S3 URL option.

3. In a new browser tab, go to the MDR Dashboard, copy the S3 Logs stack URL, and then paste it into the Amazon S3 URL field.

4. Click Next.

5. In the Specify stack details section, in the Stack name field, enter a name for the S3 log forwarding stack. For example, ArcticWolf-S3LogForward.

   Note: This name helps you identify resources that are created to collect and forward security events to Arctic Wolf. Make sure it is unique.

6. In the Parameters section, in the bucketName field, enter the name of the S3 bucket that will be used to save logs.

7. If the bucket is used for:

   • Storing security logs only — Keep the prefixPath field empty.

   • Multiple purposes — In the prefixPath field, enter a prefix to monitor for new objects. For example,<myservice>/logs.

     To lower AWS costs, only applicable data is forwarded to Arctic Wolf.

     Note: When entering the prefixPath value, do not include a trailing slash, /.

8. If the logs use encryption that is different from the AWNKMSKey, enter the ARN of the KMS key in the kmsKey field.

   Note: If the KMS key is located in a different account from the account you are deploying the CloudFormation stack, contact your CST® for configuration guidance.

9. Click Next.

   You are redirected to the Configure stack options page. Do not make changes on this page.

10. Click Next.

11. On the Review page, read the Capabilities section.

12. Select all checkboxes.

    Note: The stack is not created correctly if you do not select all checkboxes.

13. Click Submit.

    CloudFormation provides a preview of stack changes, which are prefixed with the Stack name property. This process usually takes 5 to 10 minutes to complete.

14. Wait until the base stack and all nested stacks have a status of CREATE_COMPLETE to make sure that the CloudFormation stacks were successfully created. Do not proceed to the next step until this is complete.

15. Contact your CST® to verify that Arctic Wolf is processing logs from your S3 bucket.

Configure GuardDuty with AWS Control Tower

You can configure GuardDuty for multiple accounts with AWS Control Tower if exporting to S3 is not configured.

For most environments, the base stack adds the permissions needed to the newly created log bucket. However, AWS Control Tower guardrails prevent the addition of the necessary policy.

Steps

1. Check the manual base stack configurations.
2. Configure the Control Tower GuardDuty Security account to export logs.
3. Launch the S3 CloudFormation stack.

Step 1: Check the manual base stack configurations

1. Sign in to the AWS Management Console with the log archive account.

2. In the Amazon S3 Console, select the awn-logs-bucket-<account-id>-<region> bucket, where <account-id> is your 12-digit AWS account number and <region> is the region of the bucket.

3. On the Permissions tab, in the Bucket policy section, click Edit.

4. Copy this policy, and then paste it into the Policy field:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "GuardDutyPutObject",
               "Effect": "Allow",
               "Principal": {
                   "Service": "guardduty.amazonaws.com"
               },
               "Action": "s3:PutObject",
               "Resource": "arn:aws:s3:::<bucket-name>/*"
           },
           {
               "Sid": "GuardDutyGetBucketLocation",
               "Effect": "Allow",
               "Principal": {
                   "Service": "guardduty.amazonaws.com"
               },
               "Action": "s3:GetBucketLocation",
               "Resource": "arn:aws:s3:::<bucket-name>"
           }
       ]
   }

   Where:

   • <bucket-name> is the name of your bucket.

5. Click Save changes.

Step 2: Configure the Control Tower GuardDuty Security account to export logs

1. Sign in to the AWS Management Console with the audit account.
2. Navigate to the GuardDuty console.
3. In the navigation menu, click Settings.
4. In the Findings export options section, in the Frequency section, click Edit, and then select 15 minutes.
5. Click Save changes.
6. In the Findings export options section, in the S3 Bucket section, click Configure now.
7. In the S3 bucket ARN section, enter the ARN of the bucket with a similar name to awn-logs-bucket-<account-id>-<region>, where <account-id> is the 12-digit ID number of your current AWS account and <region> is the region of the S3 bucket.
8. In the KMS Encryption section, enter the ARN of the AWNKMSKey.
9. Click Save.

Step 3: Launch the S3 CloudFormation stack

1. On the CloudFormation page, click Create stack > With new resources (standard).

2. On the Create Stack page, configure these settings:

   • Prepare template — Select the Template is ready option.
   • Template Source — Select the Amazon S3 URL option.

3. In a new browser tab, go to the MDR Dashboard, copy the S3 Logs stack URL, and then paste it into the Amazon S3 URL field.

4. Click Next.

5. In the Specify stack details section, in the Stack name field, enter a name for the S3 log forwarding stack. For example, ArcticWolf-S3LogForward.

   Note: This name helps you identify resources that are created to collect and forward security events to Arctic Wolf. Make sure it is unique.

6. In the Parameters section, in the bucketName field, enter the name of the S3 bucket that will be used to save logs.

7. If the bucket is used for:

   • Storing security logs only — Keep the prefixPath field empty.

   • Multiple purposes — In the prefixPath field, enter a prefix to monitor for new objects. For example,<myservice>/logs.

     To lower AWS costs, only applicable data is forwarded to Arctic Wolf.

     Note: When entering the prefixPath value, do not include a trailing slash, /.

8. If the logs use encryption that is different from the AWNKMSKey, enter the ARN of the KMS key in the kmsKey field.

   Note: If the KMS key is located in a different account from the account you are deploying the CloudFormation stack, contact your CST® for configuration guidance.

9. Click Next.

   You are redirected to the Configure stack options page. Do not make changes on this page.

10. Click Next.

11. On the Review page, read the Capabilities section.

12. Select all checkboxes.

    Note: The stack is not created correctly if you do not select all checkboxes.

13. Click Submit.

    CloudFormation provides a preview of stack changes, which are prefixed with the Stack name property. This process usually takes 5 to 10 minutes to complete.

14. Wait until the base stack and all nested stacks have a status of CREATE_COMPLETE to make sure that the CloudFormation stacks were successfully created. Do not proceed to the next step until this is complete.

15. Contact your CST® to verify that Arctic Wolf is processing logs from your S3 bucket.

Step 3: Enable S3 protection

1. Sign in to the GuardDuty console.
2. In the navigation menu, click Settings > S3 Protection.
3. Select the S3 Protection is enabled on this account checkbox.

Step 4: Enable EKS protection

For each of the Amazon GuardDuty accounts that you want Arctic Wolf to monitor, based on the account type, complete one of these actions:

• A single account:

  1. Sign in to the GuardDuty console.
  2. In the navigation menu, click Settings > Kubernetes protection.
  3. If you see a notice similar to "Kubernetes Audit Logs Monitoring is not enabled for this account," click Enable to enable EKS protection.

• Multiple accounts:

  Notes:

  • Only GuardDuty delegated administrator accounts can configure EKS in multi-account environments.
  • If you use AWS Organizations, this procedure automatically enables EKS protection for all new and existing accounts.
  1. Sign in to the GuardDuty console with administrator permissions.
  2. In the navigation menu, click Settings > Kubernetes protection.
  3. Click Enable all to enable automatic EKS protection for new and existing member accounts.
  4. Click Update Settings.

Next steps

• (Optional) Complete additional AWS configurations.

  For more information, see Configure AWS Account Monitoring.