Amazon GuardDuty Monitoring

Updated Sep 27, 2023

Configure Amazon GuardDuty monitoring

Amazon GuardDuty® is a threat detection service that continuously monitors your AWS accounts and resources for unexpected and potentially malicious activity in your AWS environment. To integrate this service with Arctic Wolf® Cloud Detection and Response, configure Amazon GuardDuty to forward its findings to Arctic Wolf. Your Concierge Security® Team (CST) analyzes these findings, eliminates false positives, and provides guidance within the context of your security posture.

Note: GuardDuty is a chargeable service, based on the traffic and usage of your AWS account. We recommend reviewing the GuardDuty pricing documentation before enabling the service.

Requirements

Before you begin

Steps

Note: You must complete these steps in each region that you want to forward GuardDuty findings from.

  1. Enable GuardDuty monitoring
  2. Enable S3 protection
  3. Enable EKS protection
  4. Configure GuardDuty to write logs
  5. Configure GuardDuty to export logs
  6. Verify GuardDuty configuration

Step 1: Enable GuardDuty monitoring

If you have:

Enable GuardDuty monitoring for a single account

  1. Review Supported AWS regions and identify the region that you want Arctic Wolf to monitor.

  2. Sign in to the GuardDuty console.

    The console opens to the Findings page if GuardDuty is enabled.

  3. If the Findings page does not appear, complete these steps to enable GuardDuty in your preferred AWS region:

    1. Click Get Started.

    2. Click Enable GuardDuty.

    Tip: See Enable GuardDuty in the AWS documentation for more information about enabling GuardDuty.

  4. Proceed to Enable S3 Protection.

Enable GuardDuty monitoring for multiple accounts with AWS Organizations

  1. If you use AWS Organizations:

  2. Sign in to the GuardDuty console with your delegated administrator account.

  3. In the navigation menu, click Settings > Accounts.

  4. If the Auto-enable is OFF option appears, select that option to automatically enable GuardDuty for new member accounts when they join your organization.

  5. Proceed to Enable S3 Protection.

Enable GuardDuty monitoring for multiple account without AWS Organizations

For each account you want Arctic Wolf to monitor:

  1. Sign in to the GuardDuty console.
  2. If the Findings page does not appear:
    1. Click Get Started.
    2. Click Enable GuardDuty.
  3. Proceed to Enable S3 Protection.

Step 2: Enable S3 protection

  1. Sign in to the GuardDuty console.

  2. In the navigation menu, click Settings > S3 Protection.

  3. Confirm that S3 Protection is enabled for this account.

Step 3: Enable EKS protection

Enable Elastic Kubernetes Service (EKS) protection for the GuardDuty accounts that you want Arctic Wolf to monitor.

Tips:

If you have:

Enable EKS protection for a single account

  1. Sign in to the GuardDuty console.

  2. In the navigation menu, click Settings > Kubernetes protection.

  3. If you see a notice similar to "Kubernetes Audit Logs Monitoring is not enabled for this account," click Enable to enable EKS protection.

  4. Proceed to Configure GuardDuty to write logs.

Enable EKS protection for multiple accounts

Note:

  • Only GuardDuty delegated administrator accounts can configure EKS in multi-account environments.
  • If you use AWS Organizations, this procedure automatically enables EKS protection for all new and existing accounts.
  1. As an administrator, sign in to the GuardDuty console.

  2. In the navigation menu, click Settings > Kubernetes protection.

  3. To enable automatic EKS protection for new and existing member accounts, click Enable all.

  4. Click Update Settings.

  5. Proceed to Configure GuardDuty to write logs.

Step 4: Configure GuardDuty to write logs

Note: If you have already configured GuardDuty to export logs to a S3 bucket, then stop here and contact your CST for further instructions.

How you configure GuardDuty to export logs depends on whether or not you configured Cloudtrail event monitoring in Configure AWS Cloudtrail Event Monitoring with the same account you assigned as your delegated GuardDuty administrator in the previous steps.

To check if you used the same account or a different account for these configurations:

  1. Compare the 12-digit Account ID value in the GuardDuty console to the AWS Account ID value on the Connected Accounts page in the Arctic Wolf Unified Portal.

  2. If the account numbers:

Write GuardDuty logs to the same account

To write GuardDuty logs to a local Arctic Wolf S3 bucket that is in the same AWS account:

Note: Repeat these steps for every region where you have enabled GuardDuty monitoring.

  1. Sign in to the GuardDuty console.

  2. In the navigation menu, click Settings.

  3. In the Findings export options setting, under S3 Bucket, click Configure now.

  4. Click Existing bucket in your account.

  5. Under Choose a bucket, select the bucket with a name similar to awn-logs-bucket-<account-id>-<region>, where <account-id> is the 12-digit ID number of your current AWS account and <region> is the region of the S3 bucket.

  6. Leave the Log file prefix blank.

  7. Under KMS Encryption, click Choose a key from your account.

  8. Under Key Alias, select AWNKMSKey.

  9. Click Save.

  10. Proceed to Configure GuardDuty to export logs.

Write GuardDuty logs to a different account

If you:

Step 1: Add the bucket policy for AWS Control Tower

For most environments, the base stack adds the permissions needed for the newly created log bucket. However, AWS Control Tower guardrails prevent the addition of the necessary policy.

  1. Sign in to the AWS Management Console.

  2. Open the Amazon S3 Console and select the awn-logs-bucket-<account-id>-<region> bucket, where <account-id> is your 12-digit AWS account number and <region> is the region of the bucket.

  3. Click the Permissions tab.

  4. In the Bucket policy section, click Edit.

  5. Copy this policy and paste it into the Policy field, replacing <bucket-name> with the name of your bucket:

    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Sid": "GuardDutyPutObject",
                "Effect": "Allow",
                "Principal": {
                    "Service": "guardduty.amazonaws.com"
                },
                "Action": "s3:PutObject",
                "Resource": "arn:aws:s3:::<bucket-name>/*"
            },
            {
                "Sid": "GuardDutyGetBucketLocation",
                "Effect": "Allow",
                "Principal": {
                    "Service": "guardduty.amazonaws.com"
                },
                "Action": "s3:GetBucketLocation",
                "Resource": "arn:aws:s3:::<bucket-name>"
            }
        ]
    }
  6. Click Save changes.

  7. Proceed to Write GuardDuty Logs

Step 2: Write GuardDuty logs

To write GuardDuty logs to a different AWS account that Arctic Wolf already monitors, for example, if you use AWS Organizations or AWS Control Tower:

  1. Sign in to the AWS account that Arctic Wolf already monitors in the Amazon Management Console, and then click Services > Key Management Service.

  2. In the KMS console navigation menu, click Customer managed keys.

  3. Copy the Key ID value for the AWNKMSKey key, for use in a later step.

  4. From the Services menu, click S3.

  5. In the Buckets list, select the account bucket name, similar to awn-logs-bucket-<account-id>-<region>, where the <account-id> is the 12-digit ID of the AWS account that Arctic Wolf already monitors and the <region> is the region of the S3 bucket.

    Tip: This bucket was created when you created your Arctic Wolf CloudFormation stack in Configuring AWS CloudTrail Event Monitoring.

  6. Click the Properties tab, and then copy the Amazon Resource Name (ARN) value, for use in a later step.

  7. In the Services menu, click GuardDuty to open the GuardDuty console.

  8. In the GuardDuty console navigation menu, click Settings.

  9. In the Findings export options section, under S3 Bucket, click Configure now.

  10. Click Existing bucket in another account.

  11. Under Bucket ARN, enter the bucket ARN that you copied.

  12. Under Key ARN, enter the AWNKMSKey Key ID value that you copied.

  13. Click Save.

  14. Repeat the above steps for any other region that you want to forward GuardDuty findings from.

  15. Proceed to Configure GuardDuty to export logs.

Step 5: Configure GuardDuty to export logs

Tip: See Setting the frequency for exporting updated active findings in the Amazon documentation for more information about this process.

To ensure that Arctic Wolf can send alerts in a timely manner:

  1. Sign in to the GuardDuty console.
  2. In the navigation menu, click Settings.
  3. In the Findings export options section, select Frequency for updated findings, and then select Update CWE and S3 every 15 minutes.
  4. Click Save.

Step 6: Verify GuardDuty configuration

To verify that the GuardDuty configuration works, trigger sample GuardDuty findings to write in your account:

  1. Sign in to the GuardDuty console.
  2. In the navigation menu, click Settings.
  3. On the Settings page, under Sample findings, click Generate sample findings.
  4. In the navigation menu, click Findings.
  5. The sample findings are displayed on the Current findings page with a "SAMPLE" prefix.
  6. Contact your CST to confirm that Arctic Wolf received these sample findings.

Tip: If you have access to Raw Log Search in the Arctic Wolf Unified Portal, you can check Raw Log Search for these sample findings.

Next steps

Proceed to Configure AWS S3 Bucket Log Monitoring to send logs to Arctic Wolf.

For all AWS configuration options, see Configure AWS Account Monitoring.