How to Use AWS GuardDuty: Setup and Best Practices

To use AWS GuardDuty, first enable the service in your AWS account via the AWS Management Console or AWS CLI. GuardDuty continuously monitors your AWS resources for suspicious activity and sends security findings that you can review and act upon.

Syntax

Enabling AWS GuardDuty involves specifying the detector and optionally inviting member accounts for centralized monitoring.

• DetectorId: Unique identifier for the GuardDuty detector.
• Enable: Boolean to activate GuardDuty.
• FindingPublishingFrequency: How often findings are sent (e.g., FIFTEEN_MINUTES).

bash

aws guardduty create-detector --enable

aws guardduty list-detectors

aws guardduty get-findings --detector-id <DetectorId> --finding-ids <FindingIds>

Example

This example shows how to enable GuardDuty using AWS CLI, list detectors, and retrieve findings.

bash

aws guardduty create-detector --enable

# Output will show the DetectorId

aws guardduty list-detectors

# Use the DetectorId from above to get findings
aws guardduty get-findings --detector-id <DetectorId> --finding-ids <FindingId1> <FindingId2>

Output

{
  "DetectorId": "12abc34d567e8f90123g45h6i789j0kl"
}

{
  "DetectorIds": [
    "12abc34d567e8f90123g45h6i789j0kl"
  ]
}

{
  "Findings": [
    {
      "Id": "abcd1234-5678-90ef-ghij-klmnopqrstuv",
      "Type": "Recon:EC2/PortProbeUnprotectedPort",
      "Severity": 5.0,
      "Resource": {"InstanceDetails": {"InstanceId": "i-0123456789abcdef0"}}
    }
  ]
}

Common Pitfalls

Common mistakes when using GuardDuty include:

• Not enabling GuardDuty in all AWS regions where resources exist, missing findings.
• Ignoring findings or not setting up automated responses.
• Confusing GuardDuty with other AWS security services like AWS Config or Inspector.

Always review findings regularly and integrate with AWS Security Hub or SNS for alerts.

bash

## Wrong: Not enabling GuardDuty in all regions
aws guardduty create-detector --enable --region us-east-1

## Right: Enable GuardDuty in all regions where you have resources
aws guardduty create-detector --enable --region us-east-1
aws guardduty create-detector --enable --region us-west-2

Quick Reference

Key points to remember when using AWS GuardDuty:

• Enable GuardDuty in every AWS region you use.
• Review findings regularly to detect threats early.
• Integrate GuardDuty with AWS Security Hub or SNS for alerts.
• Use member accounts for centralized threat monitoring in organizations.

Key Takeaways

Enable AWS GuardDuty in all regions where your AWS resources run.

Regularly check GuardDuty findings to identify security threats early.

Integrate GuardDuty with alerting tools like AWS Security Hub or SNS.

Use member accounts for centralized monitoring in multi-account setups.

Avoid confusing GuardDuty with other AWS security services.