AWS GuardDuty

Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts, workloads, and data stored in Amazon S3. With the cloud, the collection and aggregation of account and network activities is simplified, but it can be time consuming for security teams to continuously analyze event log data for potential threats. With GuardDuty, you now have an intelligent and cost-effective option for continuous threat detection in AWS. The service uses machine learning, anomaly detection, and integrated threat intelligence to identify and prioritize potential threats. GuardDuty analyzes tens of billions of events across multiple AWS data sources, such as AWS CloudTrail event logs, Amazon VPC Flow Logs, and DNS logs. With a few clicks in the AWS Management Console, GuardDuty can be enabled with no software or hardware to deploy or maintain. By integrating with Amazon CloudWatch Events, GuardDuty alerts are actionable, easy to aggregate across multiple accounts, and straightforward to push into existing event management and workflow systems

Topics Discussed

Benefits

You can use this document to collect and send AWS GuardDuty logs to Armor's Security Information & Event Management (SIEM). 

Pre-Deployment Considerations

Before you begin, review the following requirements:

AWS Account Information

• AWS Account Number

• AWS Access Key

• AWS Secret Key

AWS Account Permissions (Policies)

• AWS GuardDuty

• AWS Lambda

• AWS CloudWatch

• AWS CloudFormation

AMP Permissions

• Write Virtual Machine

• Delete Log Management

• Read Log Endpoints

• Read Log Relays

• Write Log Relays

• Delete Log Relays

Supported AWS GuardDuty Regions

Armor's SIEM supports the following AWS GuardDuty regions: 

Log Relay

• To learn how to add Log Relay to your account, see Obtain Log Relay for Remote Log Collection.

Update Your AWS Permissions

Based on the status of your AWS service account (existing or non-existing), review the appropriate option.  

Option 1: For existing AWS service accounts

• AWS GuardDuty

• AWS Lambda

• AWS CloudWatch

• AWS CloudFormation

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "logs:Describe*",
                "logs:Get*",
                "logs:List*",
                "logs:StartQuery",
                "logs:StopQuery",
                "logs:TestMetricFilter",
                "logs:FilterLogEvents"
            ],
            "Resource": [
                "arn:aws:logs:*:*:log-group:Armor_GuardDuty_Log_Group",
                "arn:aws:logs:*:*:log-group:Armor_GuardDuty_Log_Group:*",
                "arn:aws:logs:*:*:log-group:Armor_GuardDuty_Log_Group:*:*"
            ],
            "Effect": "Allow"
        }
    ]
}

Option 2: For non-existing AWS service accounts

1. Click the following link to create a service account in AWS:

   • https://console.aws.amazon.com/cloudformation/home#/stacks/new?stackName=armor-service-account&templateURL=https:%2F%2Fs3-us-west-2.amazonaws.com%2Flogs.armor.com%2Fservice-account%2Fcreate-armor-service-account.yml

2. Click Next.

3. Click Next.

4. Click Next.

5. At the bottom of the screen, mark the box to accept the terms, and then click Create stack or Create.
   

   • The service account will take a few minutes to create; you may need to refresh the screen to see account updates.

   • Note the name of the newly created service account.

Retrieve Your AWS Credentials

• AWS account number / account ID

• AWS Access Key

• AWS Secret Key

1. In your AWS console, access the IAM section.

2. In the left-side window, click Users.
   

3. Locate and select the service account.

   • If you created a service account using Armor's template, then select the armor_service_account user name.
     

4. Click Security credentials.

5. Click Create access key.

6. In the window that appears, copy your Access key ID and Secret access key. You will enter these keys in AMP in a later step.
   

Create A Remote Log Source Type

1. In the Armor Management Portal (AMP), in the left-side navigation, click Security.

2. Click Log & Data Management.

3. Click External Sources.

   • If this screen is blank, then click Let's Get Started.

4. Click the plus ( + ) icon.

   • If you do not have any log sources already created, then click Add a New Log Source.

5. Complete the missing fields:

   • In Endpoint, use the drop-down menu to select an already-configured endpoint.

   • In Log Source Type, click Amazon GuardDuty.

   • By default, Hostname will be populated; however, the Hostname will change after you enter your AWS credentials.

   • By default, Protocol will be populated.

6. Enter your AWS information.

   • In AWS Account Number, paste the AWS account number for your service account. You must remove any dashes or hyphens ( - ).

   • In AWS Access Key and AWS Secret Key, enter the key information for your service account.

7. Under AWS Regions, click Select All Regions.

   • For best practices, Armor and AWS recommend that you select every region.

8. Click Save Log Source.
   

9. In the window that appears, click the link to directly access your AWS account with Armor's CloudFormation StackSet or Stack template already imported.
   

Configure the AWS GuardDuty CloudFormation StackSet Template for Multiple Regions

• For multiregional , under Permissions, in the drop-down menu, select AWSCloudFormationStackSetExecutionRole, if it’s not done already, please Grant self-managed permissions

• In Specify template/Amazon S3 URL, verify that the displayed link is: https://s3-us-west-2.amazonaws.com/logs.armor.com/guard-duty-forwarding/setup-guard-duty-forwarding.yml

  

• (Required) In StackSet name, enter a descriptive name for the stack set.

  This name must begin with a letter, and can only contain letters, numbers, and hyphens.

• In Log Retention In Days, specify the number of days to maintain logs.
  By default, Armor has configured 3 days.

  

• (Optional) If required by your organization, under Tags, add your organization's tags to the CloudFormation deployment.

  

• In the Set deployment options/Accounts, enter the AWS account number for the AWS service account.

  • This is the same AWS service account number that you previously entered in AMP.

  • You must remove any dashes or hyphens ( - ).

    

• In the Set deployment options/Specify regions, add the desired region(s) for log collection.

  

• Click Next.

• At the bottom of the screen, mark the box to accept the terms, and then click Submit.

  

(Optional) Configure the AWS GuardDuty CloudFormation Stack Template for a Single Region

Verify Connection in AMP

1. In the Armor Management Portal (AMP), in the left-side navigation, click Security.

2. Click Log & Data Management, and then select External Sources.

3. Locate the newly created remote log source.

4. Under Last Event, verify that a recent activity took place.

   • This status will indicate that the configurations were successful.

   • After you update your AWS account, it may take 30 minutes for AMP to display the updates.

5. In the Armor Management Portal (AMP), in the left-side navigation, click Security.

6. Click Log & Data Management, and then select Search.

   • If Log & Data Management does not appear, then click Log Management, and then select Search.

7. In the search field, enter your AWS account number surrounded by asterisks wildcards.

   • For example, you can enter *123456789123*

   • This action will display collected AWS GuardDuty logs.

Edit A Stack

Currently, in AMP, you cannot edit an existing stack. If you want to update your stack, then you must delete the remote log source, and then create a new one with your desired updates.