Hello all and welcome to this demo. In this demo, we’ll check out how to disable or suspend GuardDuty, and configure trusted IP and threat lists.

The first thing we’ll look at is the settings section. At the very bottom of the settings page, it gives you two options, one to suspend GuardDuty and another to disable GuardDuty.

When you suspend GuardDuty, it stops monitoring your AWS environment, and it won't generate any new findings at all. But any existing findings you have will remain in the console. If however you disable GuardDuty, then again monitoring will stop and it won't generate new findings and you'll also lose all your existing findings as well. If you want a copy of those findings before you disable it, then it's best to export that data before you do so.

Next, if we go down to Lists on the left side, this is where we can perform list management of your trusted IP lists and also your threat list as well. Okay, so let's add a trusted IP list and a threat list whilst we're here. So if I click on Add a trusted IP list, specify the list name, let's just call this TrustedIP, enter the location, and I've called it TrustedIP.txt. So that's my bucket. And if I specify the format just as plain text. And you need to click on I agree to accept and agree to the GuardDuty service terms. And then click on Add list. There we've added the trusted IP list.

If we move down to a Threat list, we can do the same. So let's just call this ThreatList in the same bucket, and I've called it ThreatList.txt. Specify the format, plain text again. I agree. Add list. Then we got it. So now we have our trusted IP list and also our threat list that GuardDuty will use. And if you had a number of threat list, then you can select different ones to be active. So it's very simple to add your trusted IP list and your threat list as you can see.

Next thing to look at in the GuardDuty console is the Accounts section on the lefthand side. This is where you can set up and manage multiple accounts to use with GuardDuty.

And then finally, on the left-hand side, we have Partners, and this will take you off to a list of Amazon GuardDuty partners. That's essentially it for the console. Like I say, it's a very simple service. There's not much to it at all.

So, it's very simple to enable GuardDuty. It's simply one click and it's enabled for that region, and you just have a few menus on the left-hand side that are very self-intuitive.

That now brings me to the end of this lecture. Thanks for joining and I’ll see you next time!

Demo Part 2

SELF PACED PLATFORM

TRAINING CONTENT

JOB ROLE PATHS

CERTIFICATIONS