Hello and welcome to this lecture. Let’s talk about the data sources of Amazon GuardDuty and optional protection plans.

When you first enable GuardDuty, it automatically grants permissions to analyze logs from all of the data sources. The data sources are: VPC flow logs, AWS CloudTrail Event and Management logs, S3 data event logs, DNS query logs, EKS logs, RDS login activity, and Lambda network activity. It does this by creating a service role on your behalf.

Let’s talk about each of these data sources.

With CloudTrail Logs, you receive output from the CloudTrail service in a JSON format that contains data related to the API calls that have been made within your AWS account. GuardDuty sifts through both data event logs and management logs. Data event logs show operations performed on your AWS resources, for example, if you invoked a Lambda function or put an item in a DynamoDB table. Management logs will show management-level events, for example, setting up logging, logins to the AWS console, and setting up IAM users.

GuardDuty can also consume S3 Data plane events directly through CloudTrail logs. This is an optional feature called S3 Protection and is enabled by default when you enable GuardDuty. With S3 Data plane events, GuardDuty sifts through logs pertaining to S3 object-level events, such as API calls to get S3 objects or put S3 objects.

Next is the DNS Query Logs, these logs contain queries that DNS resolvers forward to Amazon Route 53 and they can include information such as the domain and subdomain that was requested, a timestamp of the request, the DNS record type, and the DNS response code.

Then there’s VPC Flow Logs. These logs capture and store network traffic information coming into and out of your network interfaces from instances within your VPC. They are often used to troubleshoot networking issues for instances and can be used as a security tool by monitoring what traffic is reaching your instance.

With VPC Flow Logs, you also get optional protection for other AWS services, such as Lambda. This is an optional feature called Lambda Protection and is enabled by default. This feature enables GuardDuty to analyze VPC flow logs for your Lambda functions, to protect them from potential security threats.

There are other protection plans you can enable as well. For example, with EKS protection, GuardDuty gains access to audit logs and runtime logs. Audit logs contain information about the activities of users and other applications that are using your Kubernetes Cluster API. Runtime logs require you to use an EKS add-on for your cluster that is a GuardDuty agent. Once the agent has been installed, GuardDuty can have runtime visibility and get information on file access, process execution, and network connections. While EKS audit logs are enabled by default, EKS Runtime logs are the only logs that are not enabled automatically for you. You’ll need to enable them manually within the console.

There’s also the RDS protection feature that enables GuardDuty to gain access to login activity to your Amazon Aurora databases. This helps find suspicious logins to your databases that later might escalate to threats.

Then last, there’s Malware Protection, which identifies EC2 instances, EBS volumes, or container workloads that have potentially been compromised by malware.

In summary, you have the core three data sources that are required for GuardDuty: VPC flow logs, CloudTrail logs, and DNS query logs. Then you have optional protection plans.

All of the protection plans, which means S3 protection, Lambda Protection, Malware Protection, EKS Protection and RDS Protection are optional features. All of these protection plans are enabled by default, with the exception of EKS runtime logs. With EKS protection, audit logs are enabled automatically, whereas runtime logs are not - and you have to enable those manually. However, you can choose to disable all protection plans if you’d like.

Note that with all of these log sources, GuardDuty does not manage or retain any of these logs for you. For greater management of your logging, you’ll need to go to each respective service and work with the controls there.

All right - that’s it for this one. See you next time!

Data Sources and Protection Plans

SELF PACED PLATFORM

TRAINING CONTENT

JOB ROLE PATHS

CERTIFICATIONS