GuardDuty Flashcards
(23 cards)
Basics
What is GuardDuty?
important
Continuous security monitoring service
Basics
What is GuardDuty looking for?
important
Unexpected and unauthorized activity
Basics
Analogy to help understand GuardDuty?
TSA scanning every person & bag, trained on what to look for, watching for unusual behavior
Basics
How does GuardDuty figure out what expected behavior is?
important
It learns it on its own (the ML portion of the product)
Basics
Two types of inputs to GuardDuty?
Your account/resource logs files, Threat Intelligence Feeds
Basics
5 sources of data for GuardDuty?
CloudWatch Logs, Vpc Flow logs, event logs, CloudTrail, DNS logs
Basics
Example of something in a Threat Intelligence Feed?
Known malicious source IPs
Basics
What is it looking for, what triggers it?
Anomolous behavior, ML thing looks for outliers
Basics
What does it produce?
Security Findings: you remediate or accept them
Basics
Multi-account with GuardDuty?
Yup, Master AWS account and Member AWS Accounts. One account can monitor mulitple member accounts.
Basics
GuardDuty cost structure?
Not free, charges for lots of things
Basics
How does GuardDuty work with mulitple accounts?
Master and Member accounts
Findings
Example of bad EC2 behavior that will trigger GuardDuty?
One of your EC2 instances distributing malware
Findings
How might GuardDuty think your account is compromised?
Unusual API calls, like weakening password strength requirements
Findings
What resource changes might triger GuardDuty?
Launching resources in a region you’ve never used before
Findings
What can GuardDuty do once it creates a Finding?
important
Notify or kick-off event-driven protection/remediation
Findings
How does GuardDuty notify or start event-driven stuff?
important
EventBridge
Findings
Example of how GuardDuty can shut down an outside attacker?
Finding triggers on IP addr -> Event Bridge -> Lambda -> add NACL
Protecting AWS Services
How does GuardDuty protect EKS?
Ship EKS logs to CWLogs, ingest by GuardDuty
Protecting AWS Services
How does GuardDuty protect Lambda functions?
Monitors network activity, even when not in a VPC
Protecting AWS Services
How does GuardDuty protect EC2 instances?
Scans EBS volumes for malware
Protecting AWS Services
How does GuardDuty protect RDS?
Watches for suspicious login behavior
Protecting AWS Services
How does GuardDuty protect S3 buckets?
Finding if bucket becomes public, monitor object operations
