Skip to content

AWS GuardDuty

AWS GuardDuty

About

Amazon GuardDuty is a threat detection service that continuously monitors your AWS accounts and workloads for malicious activity and delivers detailed security findings for visibility and remediation.

Product Details

Vendor URL: https://aws.amazon.com/guardduty/

Product Type: EDR

Product Tier: Tier I

Integration Method: AWS S3 Bucket

Integration URL: AWS S3 Bucket

Parser Details

Fill in the following fields for parser details

Log Format: JSON

Expected Normalization Rate: 95-100%

Data Label: GUARDDUTY

UDM Fields (list of all UDM fields leveraged in the Parser):

Log File Field UDM Field
id metadata.product_log_id
detail-type metadata.product_event_type
service.serviceName metadata.description
resource.instanceDetails.networkInterfaces.publicIp principal.ip
accountId principal.group.product_object_id
region principal.location.country_or_region
tag.value target.user.userid
network_interface.securityGroups.groupId target.user.groupid
securityGroup.groupName target.user.group_identifiers
resource.instanceDetails.platform target.asset.platform_software.platform_version
resource.instanceDetails.networkInterfaces.vpcId target.asset.attribute.cloud.vpc.id
partition target.asset.attribute.cloud.project.type
id target.asset.attribute.cloud.project.id
arn target.asset.attribute.cloud.project.product_object_id
service.action.portProbeAction.portProbeDetails.remoteIpDetails.ipAddressV4 target.ip
service.action.portProbeAction.portProbeDetails.localPortDetails.port target.port
tag.value target.application
service.action.portProbeAction.portProbeDetails.remoteIpDetails.country.countryName target.location.country_or_region
service.action.portProbeAction.portProbeDetails.remoteIpDetails.geoLocation.lat target.location.region_latitude
service.action.portProbeAction.portProbeDetails.remoteIpDetails.geoLocation.lon target.location.region_longitude
resource.instanceDetails.networkInterfaces.privateIpAddress intermediary.ip
service.additionalInfo.threatName security_result.threat_name
title security_result.summary
description security_result.description

Product Event Types

Event UDM Event Classification
Policy:S3/BucketBlockPublicAccessDisabled, Policy:S3/BucketBlockPublicAccessDisabled RESOURCE_READ
UnauthorizedAccess:EC2/RDPBruteForce, Impact:EC2/PortSweep, UnauthorizedAccess:EC2/TorClient, UnauthorizedAccess:EC2/SSHBruteForce, Backdoor:EC2/Spambot, Behavior:EC2/TrafficVolumeUnusual, Recon:EC2/Portscan, Behavior:EC2/NetworkPortUnusual NETWORK_CONNECTION
Recon:EC2/PortProbeUnprotectedPort SCAN_HOST
Stealth:IAMUser/CloudTrailLoggingDisabled, UnauthorizedAccess:IAMUser, Discovery:IAMUser/AnomalousBehavior, Policy:IAMUser/RootCredentialUsage, Discovery:IAMUser/AnomalousBehavior USER_RESOURCE_ACCESS
all others GENERIC_EVENT

Log Sample

{"schemaVersion":"2.0","accountId":"012345678901","region":"eu-central-1","partition":"aws","id":"0123456789abcdef0123456789abcdef","arn":"arn:aws:guardduty:eu-central-1:012345678901:detector/0123456789abcdef0123456789abcdef01/finding/0123456789abcdef0123456789abcdef02","type":"Recon:EC2/PortProbeUnprotectedPort","resource":{"resourceType":"Instance","instanceDetails":{"imageId":"ami-9876543210abcdef5","instanceId":"i-9876543210abcdef5","instanceType":"t2.xlarge","launchTime":"2021-08-11T09:38:17.000Z","platform":"windows","productCodes":[{"productCodeId":"dftg365wfgt145decsa2369fg","productCodeType":"marketplace"}],"iamInstanceProfile":{"arn":"arn:aws:iam::012345678901:instance-profile/SSMCloudWatchInstanceRole","id":"AIPASZSJUWL6VM3UMKZ5K"},"networkInterfaces":[{"ipv6Addresses":[],"networkInterfaceId":"eni-05d738c2a2978bf93","privateDnsName":"ip-172-16-217-212.eu-central-1.compute.internal","privateIpAddress":"172.16.217.212","privateIpAddresses":[{"privateDnsName":"ip-172-16-217-212.eu-central-1.compute.internal","privateIpAddress":"172.16.217.212"}],"subnetId":"subnet-01234567896543abc","vpcId":"vpc-01234567896543abc","securityGroups":[{"groupName":"SC-012345678901-pp-0123dfjenchtl-InstanceSG-1SH4ISOMF8BK","groupId":"sg-01234567896543abc"}],"publicDnsName":"ec1-2-34-567-890.eu-central-1.compute.amazonaws.com","publicIp":"192.168.8.10"}],"outpostArn":null,"tags":[{"key":"aws:cloudformation:logical-id","value":"EC2Instance"},{"key":"aws:servicecatalog:portfolioArn","value":"arn:aws:catalog:eu-central-1:654321987321:portfolio/port-abrncfgd12345"},{"key":"aws:cloudformation:stack-name","value":"SC-012345678901-pp-abdhrcjk12345"},{"key":"AppCat","value":"bronze"},{"key":"Environment","value":"dev"},{"key":"flagged","value":"y"},{"key":"aws:cloudformation:stack-id","value":"arn:aws:cloudformation:eu-central-1:012345678901:stack/SC-012345678901-pp-abdhrcjk12345/1a61df80-f48d-11eb-a6bf-0a87f8db6abe"},{"key":"backup","value":"n"},{"key":"aws:servicecatalog:provisionedProductArn","value":"arn:aws:servicecatalog:eu-central-1:012345678901:stack/Windows_EC2_Instance__IOT_-_Model_5_-08031832/pp-abdhrcjk12345"},{"key":"BusinessUnit","value":"HVAC"},{"key":"Application","value":"jon.doe@gmail.com,jane.doe@gmail.com"},{"key":"lxAppId","value":"APP-01664"},{"key":"Version","value":""},{"key":"MaxLifeTime","value":"1y"},{"key":"Stopped","value":"True"},{"key":"FQDN","value":""},{"key":"aws:servicecatalog:provisioningPrincipalArn","value":"arn:aws:sts::012345678901:assumed-role/AWSReservedSSO_SupportG-AWS-GCSOps_605778c0e395721b/jane.doe@gmail.com"},{"key":"ServerRole","value":"Database Server"},{"key":"CostCenter","value":"IC990272"},{"key":"ApplicationOwner","value":"jon.doe@gmail.com"},{"key":"ComplianceRequirement","value":""},{"key":"timestamp","value":"1629887588.0"},{"key":"Name","value":"VMC12345SA678"},{"key":"Patching","value":"Excluded from patching - LTI"},{"key":"Patching_Tag","value":"Excluded from patching - LTI"},{"key":"aws:servicecatalog:provisioningArtifactIdentifier","value":"pa-0123456789012"},{"key":"aws:servicecatalog:productArn","value":"arn:aws:catalog:eu-central-1:012345678901:product/prod-9876543210987"}],"instanceState":"running","availabilityZone":"eu-central-1a"}},"service":{"serviceName":"guardduty","detectorId":"9876543210dfg0123456789d","action":{"actionType":"PORT_PROBE","portProbeAction":{"portProbeDetails":[{"localPortDetails":{"port":443,"portName":"Unknown"},"remoteIpDetails":{"ipAddressV4":"192.168.3.5","organization":{"asn":"555555","asnOrg":"My Org","isp":"My ISP","org":"My ISPs Org"},"country":{"countryName":"United States"},"city":{"cityName":""},"geoLocation":{"lat":38.123,"lon":-94.321}}},{"localPortDetails":{"port":445,"portName":"SMB"},"remoteIpDetails":{"ipAddressV4":"192.168.3.2","organization":{"asn":"555555","asnOrg":"My Org","isp":"My ISP","org":"My ISPs Org"},"country":{"countryName":"United States"},"city":{"cityName":""},"geoLocation":{"lat":12.345,"lon":-54.321}}},{"localPortDetails":{"port":135,"portName":"Unknown"},"remoteIpDetails":{"ipAddressV4":"192.168.5.1","organization":{"asn":"555555","asnOrg":"My Org","isp":"My ISP","org":"My ISPs Org"},"country":{"countryName":"United States"},"city":{"cityName":""},"geoLocation":{"lat":98.765,"lon":-56.789}}},{"localPortDetails":{"port":139,"portName":"NetBIOS"},"remoteIpDetails":{"ipAddressV4":"192.168.5.4","organization":{"asn":"55555","asnOrg":"Your Org.","isp":"Your ISP","org":"Your ISPs Org"},"country":{"countryName":"Monaco"},"city":{"cityName":"Monaco"},"geoLocation":{"lat":98.876,"lon":56.789}}},{"localPortDetails":{"port":5986,"portName":"Unknown"},"remoteIpDetails":{"ipAddressV4":"192.168.1.1","organization":{"asn":"444444","asnOrg":"Their Org","isp":"Their ISP","org":"Their ISPs Org"},"country":{"countryName":"United States"},"city":{"cityName":""},"geoLocation":{"lat":12.345,"lon":-54.321}}}],"blocked":false}},"resourceRole":"TARGET","additionalInfo":{"threatListName":"ProofPoint","value":"{\"threatListName\":\"ProofPoint\"}","type":"default"},"evidence":{"threatIntelligenceDetails":[{"threatNames":[],"threatListName":"ProofPoint"}]},"eventFirstSeen":"2023-05-23T18:46:03.000Z","eventLastSeen":"2023-05-31T20:43:04.000Z","archived":false,"count":205},"severity":2,"createdAt":"2023-05-23T19:04:41.461Z","updatedAt":"2023-05-31T20:57:49.939Z","title":"Unprotected port on EC2 instance i-1234567890abcdef5 is being probed.","description":"EC2 instance has an unprotected port which is being probed by a known malicious host."}

Sample Parsing

metadata.product_log_id = "0123456789abcdef0123456789abcdef"
metadata.product_event_type = "Recon:EC2/PortProbeUnprotectedPort"
metadata.event_type = "SCAN_HOST"
metadata.description = "guardduty"
principal.ip = "192.168.8.10"
principal.group.product_object_id = "012345678901"
principal.location.country_or_region = "eu-central-1"
target.user.userid = "jon.doe@gmail.com"
target.user.groupid = "sg-01234567896543abc"
target.user.group_identifiers = "SC-012345678901-pp-0123dfjenchtl-InstanceSG-1SH4ISOMF8BK"
target.asset.platform_software.platform_version = "windows"
target.asset.attribute.cloud.vpc.id = "vpc-01234567896543abc"
target.asset.attribute.cloud.project.type = "aws"
target.asset.attribute.cloud.project.id = "0123456789abcdef0123456789abcdef"
target.asset.attribute.cloud.project.product_object_id = "arn:aws:guardduty:eu-central-1:012345678901:detector/0123456789abcdef0123456789abcdef01/finding/0123456789abcdef0123456789abcdef0"
target.ip = "192.168.3.5"
target.ip = "192.168.3.2"
target.ip = "192.168.5.1"
target.ip = "192.168.5.4"
target.ip = "192.168.1.1"
target.port = "5986"
target.application = "jon.doe@gmail.com,jane.doe@gmail.com"
target.location.country_or_region = "United States"
target.location.region_latitude = "38.123"
target.location.region_longitude = "-94.321"
intermediary.ip = "172.16.217.212"
security_result.threat_name = "ProofPoint"
security_result.summary = "Unprotected port on EC2 instance i-1234567890abcdef5 is being probed."
security_result.description = "EC2 instance has an unprotected port which is being probed by a known malicious host."