AWS GuardDuty

Question 1

What is GuardDuty?

Answer 1

Threat detection, GD is looking at data sources in your account and identifying if there is a threat.

Question 2

What is the structure of Guard Duty?

Answer 2

You have one account where Gard Duty is used and you can then invite other accounts, such as accounts in your orgnization.

Question 3

How does Guard-duty identify threats?

Answer 3

Guard-duty monitors

• Route 53
• VPC Flow Logs
• CloudTrail
• AWS Accounts

Question 4

What is a Guard-duty finding?

Answer 4

This is an item thet is produced by GD when it detects a threat. We at a bunch of info like Severity, Region, Count, Threat Type, Affected Resource, Source info

Question 5

How do I receive events form GuardDuty?

Answer 5

CloudWatch Events, you can use CWE to trigger on other resources such an SNS, Lambda, etc.

Question 6

What are the sources GuardDuty is monitoring?

Answer 6

• Route 53
• VPC Flow Logs
• CloudTrail
• AWS Accounts

Question 7

How cna you get threat intelligence form other accounts in you orgnization?

Answer 7

With GuardDuty you can invite other accounts in you orgnization to join and this becomes the master account.

Question 8

Can an AWS account be a member of multiple GuardDutys account?

Answer 8

No

Question 9

What have you to set up in GuardDuty to get GD started?

Answer 9

Service role permissions

Question 10

I have several IPs that are showing up in GuardDuty as a threat, what cna I do to stop this?

Answer 10

You can place the IP’s on a threat list to have them excluded from GD findings.

Question 11

I have knowing bad actor IP’s that I would like to know if these are seeing on our AWS networks, how cna I make this happen?

Answer 11

Add then to the threat list and these will be identified.

Question 12

How many threat lists can you have per account?

Answer 12

You cna have 6 threat list per region per account.

Question 13

How many trusted lists can you have per account?

Answer 13

You cna have 1 per region per account.

Question 14

Are GuardDuty finding real-time?

Answer 14

No

Question 15

Can you managed multiple accounts with guard duty?

Answer 15

Yes, it a bit different than other AWS services, you can ask other accounts to join.

Question 16

Is the guard duty account the same as the org master account?

Answer 16

No, completely different, GD can be any aw2s acc you chose it to be, you then use GD to ask other accounts join.

Question 17

Can an AWS account be a member of more than one GD?

Answer 17

No, only be a member of one GD.

Question 18

I am getting my findings from guard duty, when I investigate I find they are false and the device is an external device on the internet belong to me, how can I fix this, should I contact aws?

Answer 18

No, do not contact AWS. Just add IP to the whitelist.

Question 19

I know there are bad actors coming from an IP, is it possible to add this to GuardDuty?

Answer 19

Yes, add it to the threat list.

Question 20

Is there one trusted list per GD or one per account?

Answer 20

One per account.

Question 21

Are the finding in GD realtime?

Answer 21

No, but they arrive prompt.