AWS GuardDuty

About the Device

Amazon GuardDuty is a security monitoring service that analyzes and processes Foundational data sources, such as AWS CloudTrail management events, AWS CloudTrail event logs, VPC flow logs (from Amazon EC2 instances), DNS logs, Kubernetes audit logs, RDS login activity, S3 logs, EBS volumes, Runtime monitoring, and Lambda network activity logs.

Device Information

Entity	Particulars
Vendor Name	Amazon Web Services
Product Name	GuardDuty
Type of Device	Cloud

Collection Method

Log Type	Ingestion label	Preferred Logging Protocol	Log Collection Method	Data Source
AWS GuardDuty	GUARDDUTY	API Pull	C2C - Storage	https://cloud.google.com/chronicle/docs/reference/feed-management-api#cortex-xdr

Device Configuration

Adaptive MxDR supports log collection using either S3 or SQS.

Prerequisite:

S3 bucket is created. Please refer the following page to create a S3 bucket. https://docs.aws.amazon.com/AmazonS3/latest/userguide/creating-bucket.html
KMS Key is created. Please refer the following page to create a KMS Key.https://docs.aws.amazon.com/kms/latest/developerguide/asymm-create-key.html
GuardDuty encrypts the findings data in your bucket by using an AWS KMS key. GuardDuty should have permission to access KMS key.
- Please refer the following page to grant KMS key permission to GuardDuty: https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_exportfindings.html

{
            "Sid": "Allow GuardDuty to encrypt findings",
            "Effect": "Allow",
            "Principal": {
                "Service": "guardduty.<AWS_REGION>.amazonaws.com"
            },
            "Action": [
                "kms:Encrypt",
                "kms:GenerateDataKey"
            ],
            "Resource": "<KEY_ARN>"
        }

Please replace <AWS_REGION>, <KEY_ARN> placeholders with actual values.

Configuring AWS GuardDuty

Sign in to AWS Console
Search for GuardDuty service
Click Settings

In Finding export options:

a. Select the Frequency for updated findings as Update CWE and S3 every 15 minutes

This frequency selection is for updated findings only, new findings will be exported in 5 minutes from the creation time.

b. Select the S3 bucket in which you want to export GuardDuty findings. You can select existing bucket or create a new bucket.

c. Provide the Log file prefix if you wish to give any.

d. Select KMS encryption and select Key alias.

e. Click Save.

If you would like to use SQS, please follow below steps:

Follow all steps provided above to store logs in S3 bucket
Create SQS and attach it with S3. Please refer Configuring AWS Simple Queue Service (SQS) with S3 Storage

Please refer below page to check required IAM user and KMS Key policies for S3, SQS and KMS

IAM User and KMS Key Policies Required for AWS

For more details on how to get required credentials for integration parameters please refer:

Get Credentials for AWS Storage

Below are the URL details which we need to allow for connectivity (Please identify URLs by referring AWS document according to your services and regions:)

IAM: For any logging source IAM URL should be allowed

https://docs.aws.amazon.com/general/latest/gr/iam-service.html

S3: For S3 or SQS logging source, S3 URL should be allowed.

https://docs.aws.amazon.com/general/latest/gr/s3.html

SQS: For SQS logging source, SQS URL should be allowed.

https://docs.aws.amazon.com/general/latest/gr/sqs-service.html

Integration Parameters

S3

Property	Default Value	Description
REGION	N/A	Select the region of your S3 bucket
S3 URI	N/A	The S3 URI to ingest. (It will be a combination of S3 bucket name and prefix. Example: S3://<S3 bucket name>/<prefix>)
URI IS A	N/A	The type of file indicated by the URI. Valid values are: `FILES`: The URI points to a single file which will be ingested with each execution of the feed. `FOLDERS`: The URI points to a directory. All files contained within the directory will be ingested with each execution of the feed. `FOLDERS_RECURSIVE`: The URI points to a directory. All files and directories contained within the indicated directory will be ingested, including all files and directories within those directories, and so on.
SOURCE DELETION OPTION	N/A	Whether to delete source files after they have been transferred to Chronicle. This reduces storage costs. Valid values are: `SOURCE_DELETION_NEVER`: Never delete files from the source. `SOURCE_DELETION_ON_SUCCESS`:Delete files and empty directories from the source after successful ingestion. `SOURCE_DELETION_ON_SUCCESS_FILES_ONLY`:Delete files from the source after successful ingestion.

SQS

Property	Default Value	Description
REGION	N/A	Select the region of your S3 bucket
QUEUE NAME	N/A	The SQS queue name.
ACCOUNT NUMBER	N/A	The account number for the SQS queue and S3 bucket.
QUEUE ACCESS KEY ID	N/A	This is the 20 character ID associated with your Amazon IAM account.
QUEUE SECRET ACCESS KEY	N/A	This is the 40 character access key associated with your Amazon IAM account.
SOURCE DELETION OPTION	N/A	Whether to delete source files after they have been transferred to Chronicle. This reduces storage costs. Valid values are: `SOURCE_DELETION_NEVER`: Never delete files from the source. `SOURCE_DELETION_ON_SUCCESS`:Delete files and empty directories from the source after successful ingestion. `SOURCE_DELETION_ON_SUCCESS_FILES_ONLY`:Delete files from the source after successful ingestion.