【Guidelines】Consideration for introducing Amazon GuardDuty to Corporate Organization/System

Created date: 2025/01/22, Update date: 2025/01/22

Amazon GuardDuty is a service that monitors and threats activities in the AWS account.
In this article, we have described the summary of the Amazon GuardDuty and the points to be confirmed when considering the introduction into a company organization/system.

Table of contents

Revised history
What is Amazon GuardDuty?
Examination of introduction
1. ① Are you using IDS/IPS products?
Guidelines formulation
1. ① Examination of protection functions to be enabled
2. ② Rolly assignment arrangement

Revised history

Date	Update contents
2025/01/22	・ “GuardDuty Malware Protection for S3” “GuardDuty Runtime Monitoring” is added ・ Updated linked

What is Amazon GuardDuty?

Amazon GuardDuty (hereinafter abbreviated: GD) is a managed threat type threatening service that monitor activities in the AWS account and detect unauthorized actions and suspicious activities.
The GD is AWS collecting and analyzing the AWS CloudTrail log, Amazon VPC Flo Log, and DNS logs to detect illegal activities.
- It is often misunderstood, but there is no need to enable CloudTrail and VPC Flow Log to use GD.

In GD, the following 7 threat detection functions can be used optionally in addition to the basic data source.
- GuardDuty EKS Protection
- GuardDuty Lambda Protection
- GuardDuty Malware Protection for EC2
- GuardDuty Malware Protection for S3
- GuardDuty RDS Protection
- GuardDuty S3 Protection
- GuardDuty Runtime Monitoring

It is recommended that you use a free trial first to check how much it costs because you can make a 30 -day free trial.

Examination of introduction

① Are you using IDS/IPS products?

GD is classified as IDS/IPS (Intrusion Detection System).
If you are using IDS/IPS products in an existing environment, you need to consider combination with GD.
- IDS only makes notifications when you find an abnormal communication, but IPS can block not only notifications but also communication when you find abnormal communication.
- IPS can provide quicker response compared to IDS, but also has a large business impact.
  - This is because if the setting is fraudulent, a misjudgment can be performed, which can lead to an immediate system stop.

GD uses machine learning, so you can detect Blue Force attacks and suspicious API notifications.
The following table has organized the type of attack and communication that is detected/blocked by the GD and Network Firewall managed drools.
- Reference:
  - GuardDuty finding types - Amazon GuardDuty
  - Using AWS managed rule groups in AWS Network Firewall - AWS Network Firewall

Category	Item	GuardDuty	Network Firewall
Attack	Malware	○	○
〃	DoS/DDoS	○	○
〃	Zero day (vulnerability)	○	○
〃	Fishing	○	○
〃	Blue Force	○	-
Communication	Botnet	○	○
〃	Anonymous communication (tor)	○	-
〃	Suspicious communication source/communication destination	○	○
〃	Suspicious API communication	○	-
〃	Other suspicious communication	○	○
Settings	Kubernetes setting incomplete	○	-

If you use existing IDS/IPS products or Network Firewall, you will not use GD.

Guidelines formulation

① Examination of protection functions to be enabled

In GD, the followinga 7 threat detection functions can be used optionally.Consider which threat detection function is enabled as a company.

No	Protection	Overview	Price (Tokyo Region)
01	S3 Protection	Monitor both CloudTrail management events and data events and analyze the API operations of the Amazon S3 bucket.	1.04 USD per million events (最First 500 million events/month)
02	RDS Protection	Analyze the login activity of the Amazon Aurora database.	1.33 USD per VCPU
03	Malware Protection for EC2	If a threatening activity is detected, scan the EBS attached to the Amazon EC2 instance or container workroad.	0.05 USD per GB
04	Malware Protection for S3	Scan the file uploaded to the S3 bucket to detect malware.	0.60 USD per GB
05	EKS Protection	Monitor EKS audit logs and runtime to analyze applications, control planes and events.	Audit Log: 2.48USD/1 million events (First 100 million events/month) EKS runtime monitoring: 2.00USD per VCPU (The first 500 VCPU /Moon)
06	Lambda Protection	Analyze Lambda network activity logs.	1.18 USD per GB (The first 500 gb/month)
07	Runtime Monitoring	Match resources such as Lambda, EC2, Fargate.	1.50 USD per VCPU (The first 500 VCPU /Moon)

Reference

When considering the enabling threat detection function, it is important to check that the GD detection content has not been countermeasures and detection in other designs.

The following is a list of detection results type and countermeasures/detection methods in S3 Protection.
- GuardDuty S3 Protection finding types - Amazon GuardDuty

I think it is basically possible to take measures/detect using the functions of other AWS services.

GuardDuty S3 detection result type	Default importance	Presence or absence of measures/detection methods
Discovery:S3/AnomalousBehavior	Low	Applicable (*1)
Discovery:S3/MaliciousIPCaller	high	Applicable (*1)
Discovery:S3/MaliciousIPCaller.Custom	high	Applicable (*1)
Discovery:S3/TorIPCaller	middle	Applicable (*1)
Exfiltration:S3/AnomalousBehavior	high	Applicable (*1)
Exfiltration:S3/MaliciousIPCaller	high	Applicable (*1)
Impact:S3/AnomalousBehavior.Delete	high	Applicable (1,4)
Impact:S3/AnomalousBehavior.Permission	high	Applicable (1,2,*3)
Impact:S3/AnomalousBehavior.Write	middle	Applicable (*1)
Impact:S3/MaliciousIPCaller	high	Applicable (*1)
PenTest:S3/KaliLinux	middle	Applicable (*1)
PenTest:S3/ParrotLinux	middle	Applicable (*1)
PenTest:S3/PentooLinux	middle	Applicable (*1)
Policy:S3/AccountBlockPublicAccessDisabled	Low	Applicable (*2)
Policy:S3/BucketAnonymousAccessGranted	high	Applicable (2,3)
Policy:S3/BucketBlockPublicAccessDisabled	Low	Applicable (*2)
Policy:S3/BucketPublicAccessGranted	high	Applicable (*2)
Stealth:S3/ServerAccessLoggingDisabled	Low	Applicable (*2)
UnauthorizedAccess:S3/MaliciousIPCaller.Custom	high	Applicable (*1)
UnauthorizedAccess:S3/TorIPCaller	high	Applicable (*1)

*1: Deleting IAM authentication information, restrictions on the source IP, MFA device authentication
*2: Security Hub、Config
*3: Access Analyzer
*4: Prohibition of operation by SCP

② Rolly assignment arrangement

The main tasks generated during GD operation are the following four.

Initial setup of detector
Confirmation of detection results/correspondence
Filtering the detection result (tuning)
Introduction of function updates

Basically, it is the role of the base team to enable security -based AWS services, so it is assumed that the foundation team will be in charge of “1. Initial setup of detectors” and “4. Introduction of function updates”.。
“2. Confirmation of detection results/correspondence” and “3. Filtering the detection result (tuning)” are difficult to respond unless they know the system design, so they often respond to system staff.I think.
Let’s judge the role sharing depending on how far the authority of AWS services have been delegated.