your IT infrastructure File created on a system The user logged in to the system System shut down Incident An Event that negatively affects IT systems and impacts the business System out of memory/disk Power/hardware failure Host/network unreachable Security Incident potentially jeopardizes the CIA Triad of an information system Malware installed on a system Unauthorized access to system Software vulnerability exploited
uses machine learning, anomaly detection, and integrated threat intelligence to identify and prioritize the potential security incident. Use Cases: Improves Security Operations visibility. Assists in investigations and automated remediations. Detect and mitigate threats in container environments. Malware Identification.
Logs Cloudtrail Events EKS Control Plane logs VPC Flow Logs capture information about IP traffic flowing in and out of your VPC. These provide visibility into network traffic at the network interface level within your VPC. DNS logs are based on the queries made from Amazon EC2 instances to any domains. AWS CloudTrail is a service that captures and logs API calls made to the AWS Management Console or AWS SDK EKS control-plane logs are the logs generated by the Kubernetes control-plane components running in your EKS cluster.
Machine Learning Model, to determine if the new activity is considered normal or abnormal Generates findings for EC2, IAM, and S3. How GuardDuty learns about the AWS environment?
gives you accurate threat detection of compromised accounts Account compromise, such as AWS resource access from an unusual geo-location at an atypical time of day. For programmatic AWS accounts, GuardDuty checks for unusual application programming interface (API) calls, such as attempts to obscure account activity by disabling CloudTrail logging or taking snapshots of a database from a malicious IP address.
in the AWS Management Console or a single API call, you can activate Amazon GuardDuty on a single account. Once turned on, GuardDuty immediately starts analyzing continuous streams of account and network activity in near real-time and at scale. It is a managed service
Amazon GuardDuty continuously monitors and analyzes your AWS account and workload event data found in AWS CloudTrail, VPC Flow Logs, EKS audit and system logs, and DNS Logs. There is no additional security software or infrastructure to deploy and maintain. Threat intelligence is pre-integrated into the service and is continuously updated and maintained.
generating unusually large amount of traffic to a remote host Basically, it deviates from established baseline No prior history of sending this much traffic to a remote host
instance is interacting with an IP associated with crypto activity Hackers use compromised resources for bitcoin mining Requires investigation. If it is a valid use case, you can set up a suppression rule for it
interrupt, or destroy data in your account. Activities like deleting security groups etc. Anomaly detection and Machine Learning (ML) model AWS Environment Impact:IAMUser/AnomalousBehavior
and container infrastructure. Reduce mean time to resolve (MTTR) vulnerabilities with automation. Vulnerability management with a fully managed and highly scalable service. Amazon Inspector
AWS Security Hub, and AWS Event Bridge to automate the security workflow. Inspector findings can be automatically sent to AWS Security Hub, which acts as a centralized hub for security-related findings and insights across your AWS environment. Security Hub provides a comprehensive view of your overall security posture. For example, you can configure Security Hub to trigger an automated response when critical or high-risk findings are detected. This automation can include actions like sending notifications, generating tickets, or triggering remediation processes.
package vulnerabilities include finding identified from AWS workloads that are exposed to Common Vulnerabilities and Exposures, CVEs. Network reachability findings reveal that there are accessible network paths to your Amazon EC2 instances within your environment. These findings bring attention to network configurations that may be excessively permissive, such as poorly managed security groups, Access Control Lists, or internet gateways, which could potentially allow for unauthorized access or malicious activity.
a risk score of 9.0-10.0 signifies critical risks. High: Findings with a risk score of 7.0-8.9 signifies high-risk discoveries. Medium: Findings with a risk score of 4.0-6.9 signifies moderate-risk observations. Low: Findings with a risk score of 0.1-3.9 signifies low-risk identifications. Informational: Findings with a risk score of 0.0 signifies informational findings. AWS Inspector assigns a risk score, ranging from 0.0 to 10.0, indicating the potential impact and risk it poses to your environment. These findings are categorized into different severity of vulnerabilities.
feature, we can search if AWS Inspector covers particular CVEs in the scans or not. It will give you data from the National Vulnerability database data, CVSS Score, and EPSS score. A suppression rule serves as a predefined set of filter criteria that effectively excludes findings meeting those criteria from appearing in your active findings lists. Suppression rules are particularly useful for eliminating low-value findings or findings that are irrelevant to your specific environment. 5) Suppression Rules
a risk score of 9.0-10.0 signifies critical risks. High: Findings with a risk score of 7.0-8.9 signifies high-risk discoveries. Medium: Findings with a risk score of 4.0-6.9 signifies moderate-risk observations. Low: Findings with a risk score of 0.1-3.9 signifies low-risk identifications. Informational: Findings with a risk score of 0.0 signifies informational findings. AWS Inspector assigns a risk score, ranging from 0.0 to 10.0, indicating the potential impact and risk it poses to your environment. These findings are categorized into different severity of vulnerabilities.
from Layer 3,4 Attacks Protects from SYN/UDP Floods – DDoS attacks Optional DDOS mitigation service 24/7 access to AWS DDoS response team Protects from web app attacks Monitors HTTP, and HTTPS requests and block malicious requests. Protect from SQL Injection and Cross-site scripting Pre-configured rule groups for OWASP top 10, CVE, IP reputation List, Anonymous list etc. AWS Shield Standard AWS Shield Advanced AWS Web Application Firewall – WAF
sankalpsp07
uhyo
oracle4engineer
irinanazarova
cybozuinsideout
kongmingstrap
tamaiyutaro
tkengo
oleur
ktc_wada
trycycle
akagire
tahia910
trallard
sstephenson
phodgson
colly
gr2m
pedronauck
csswizardry
lynnandtonic
mthomps
deanohume
marcelosomers
lauravandoore
