Guide to AWS GuardDuty Best Practices
Tags: aws, guardduty, webdev, security
Published: 2023-11-10 09:46:59

## **What Is AWS GuardDuty**

Amazon Guard Duty is a security service for AWS. It monitors logs in your AWS environment, detects threats and alerts you about vulnerabilities.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0kcjnld0mz7m06h0bils.png)

The good thing about GuardDuty is that it’s highly automated. It finds threats with Machine Learning, anomaly detection, and 3rd party data. It builds patterns that find potential security issues.

Note, that Guard Duty doesn’t prevent issues, but only detects them. That’s why GuardDuty alone won’t protect you from issues like DDoS attacks. But you can pair GuardDuty with AWS Shield for maximum security.

## **What Logs Does GuardDuty Track**

Some of the data sources are foundational, others are optional.

Here are the main log sources that GuardDuty tracks. For all 3, GuardDuty starts monitoring automatically right after you enable the service.

- **AWS CloudTrail** logs capture API activity in your AWS account. GuardDuty helps find unauthorized access or compromised credentials.
- **VPC Flow** logs show IP traffic going in and out of the Virtual Private Cloud network.
- **DNS** logs that turn domain names into IP addresses.

Additionally, GuardDuty can track logs within these AWS services:

- EKS protection includes audit log and runtime monitoring.
- Lambda network activity logs can show malicious code in Lambda functions.
- EBS volumes that are attached to EC2 are scanned for malware.
- RDS login activity shows access threats.
- S3 protection looks for security risks in API operations.

## **What Happens When GuardDuty Finds a Threat**

When there are any security findings, GuardDuty passes them forward. Here’s how it works:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2e24xpfahzkb8v7jyutn.png)

1. GuardDuty findings pass to CloudWatch Events in 5 minutes after they are detected.
2. CloudWatch Event has 2 targets: SNS and Firehose. You can use Lambda functions to filter the findings.
3. Firehose stream delivers targets to S3 Buckets for long-term archiving. It also goes to Elasticsearch.
4. You can use Kibana, the built-in Elasticsearch plugin for visualization and operational analytics.
5. Cognito user pools are used for authentication.
6. SNS will send email and SMS notifications when GuardDuty finds a threat.

## **What Does GuardDuty Protect Me from**

**Unusual Behavior.** GuardDuty carefully checks all unauthorized attempts to access your network including the API calls. It looks at anything out of the ordinary: login attempts from strange places, misused credentials, or sudden spikes in traffic.

**Malware.** It tracks your network for malicious software, like trojans and crypto miners. Basically, it scans EBS volumes attached to the EC2 instances and container workloads. Note, that malware scans come at additional price – after the trial period you’ll pay for EBS volume snapshots.

**Data Breaches.** GuardDuty watches for signs of data breaches or irregular data transfer patterns in your AWS infrastructure. It’s vigilant for large or unexpected data transfers, unusual access patterns, or any activities that could indicate unauthorized movement or potential loss of data.

**Network Insecurities.** GuardDuty monitors traffic for known malicious botnets or command-and-control servers. It flags suspicious DNS-related activities that might indicate data exfiltration.

## **How Is GuardDuty Different from Other AWS Security Services**

It’s easy to get lost between many AWS services, so let’s figure them out.

**Security Hub** aggregates findings from many AWS services – including GuardDuty. When GuardDuty finds a threat, it may go to Security Hub where it can get neutralized.

**Inspector** focuses on vulnerabilities in AWS applications, while Guard Duty finds threats in event logs. In other words, GuardDuty looks at what happened, and Inspector checks what can happen.

**Macie** protects **[sensitive data](https://aristeksystems.com/blog/pii-security-requirements-in-elearning/)** in S3 buckets. It can also ensure compliance with regulations like **[HIPAA](https://aristeksystems.com/industries/healthcare/)**. Yet, Macie and GuardDuty serve different purposes, and they don’t directly integrate with each other.

**Shield** protects from DDoS attacks, while GuardDuty can add insights into the attacks to help Shield fight them. These services serve different purposes, but can work together to fight DDoS.

**WAF** is a firewall that monitors HTTP and HTTPS traffic. It prevents exploits like SQL injection and XSS in web apps. While GuardDuty works like an antivirus, WAF is an intelligent firewall.

**Trusted Advisor** mainly helps to optimize costs and performance. But it also addresses the security gaps. TA can ensure that you follow best practices and standards in security.

**SIEM** looks over the entire network, while GuardDuty checks the entrance to it. SIEMS stands for Security information and event management. While Guardduty is not a SIEM, there are many different SIEM tools like Splunk or IBM QRadar.

**IDS** means Intrusion Detection System. GuardDuty is a cloud-centric IDS, that’s somewhat different from traditional IDS. Traditional IDS monitor network traffic at specific control points using preconfigured rules, while GuardDuty analyzes a broader spectrum of events including API calls and serverless services.

## **AWS GuardDuty Best Practices**

GuardDuty is highly automated, so in many ways it takes care of itself. There’s a simple and straightforward [setup guide](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_settingup.html). It only takes a few minutes to enable all foundational services.

You can fine tune GuardDuty as well. Amazon made an hour-long webinar with [GuardDuty tips](https://pages.awscloud.com/AWS-Office-Hours-Amazon-GuardDuty-Tips-and-Tricks_1114-SID_OD.html). Watch it for a deep dive or read a quick breakdown.

Here’s are some best practices, though:

**Link All of Your AWS Accounts.** If you have multiple accounts, set up a master member to centralize GuardDuty. You can use the [multi account script](https://github.com/aws-samples/amazon-guardduty-multiaccount-scripts) to speed up the process.

**Update Your IP Address Lists** – both trusted and threat lists. You can purchase threat feeds from third-party companies like Crowdstrike or generate your own lists.

**Use Filters to Archive Expected Findings.** When you run a security assessment, you expect GuardDuty alerts. But you don’t have to clutter your findings list with them. Hide and archive them instead.

## **How to Optimize GuardDuty Pricing**

GuardDuty pricing is complicated. It charges you per analyzed data, measured in gigabytes and the number of security findings. AWS has a [pricing calculator](https://calculator.aws/#/addService/guardduty), but it’s too tangled for real life.

To make it easier, Amazon offers a free monthly trial. This way, you’ll track potential costs, but won’t need to pay for them. Keep in mind that the trial will estimate your current spendings. If your application is scaling, so will the GuardDuty costs.

To prevent extra costs, make as few calls as possible. You can use cache or change the calling intervals. Or reduce unnecessary CloudTrail data with suppression rules. Sometimes, it’s wise to disable S3 and EKS in non-business critical regions.

If you need help balancing GuardDuty costs, **[reach out](https://aristeksystems.com/contact/)** to us. We’ll save your AWS budget, so you don’t have to pay extra every month. All while keeping the cloud secure.