Amazon GuardDuty and AWS Security Hub - Incident response with the help of detective controls
Tags: beginners, tutorial, security, aws
Published: 2022-07-26 12:26:00


![cost explorer](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/c4pue1kk517subgkqnk9.jpg)

## Finding the needle in the haystack

If you have been following this series on security from this first [blog](https://dev.to/aws-builders/aws-cost-explorer-cost-anomaly-detection-report-identifed-an-unauthorized-amazon-sagemaker-canvas-user-3524) you will understand various remediation steps completed to remove unauthorized user access from the 'unprepared' AWS account.

I have been monitoring daily usage to identify any new Amazon Sagemaker Canvas charges from user 'michael-c' from region US-East-(N.Virginia). 

From inspecting the daily AWS Cost Explorer dashboard in the section unblended costs, there were no new Amazon Sagemaker charges incurred in region US-East-1 after the implementation of Amazon Guard Duty and Trusted Advisor.

![usage](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/v78l3wkothsi44cgtes5.jpg)

In this blog post you will learn how the combination of Amazon Guard Duty and AWS Security Hub work in harmony to quickly protect your AWS accounts against suspicious activity, with the ability to identify unauthorized user access, monitor any unusual API calls and reduce surprise bills.

### Solution overview

After enabling Amazon GuardDuty and AWS Security Hub, the AWS Trusted Advisor high risk recommendations were implemented as remediation actions. As a result, there were no further unauthorized user access or any new Amazon Sagemaker Canvas usage charges in US-East-region after 21 July 2022. This is a quick win as you can see from the diagram below. 

![no new charges](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gwp4xitqovkq1rbk19yj.jpg)

I upgraded my AWS Support Plan from **Basic** to **Developer** so that I could access 7 core AWS Trusted Advisor recommendations for best practice with a price of $29 per month.

You may also implement the **Business** or **Enterprise** AWS Support plan if you would like to subscribe and pay for the full-access to all of the Trusted Advisor best practice recommendations. Here is a [link](https://aws.amazon.com/premiumsupport/plans/) to the different AWS Support Plans that you may select for your test and production workloads.

### Amazon GuardDuty 

Amazon GuardDuty uses machine learning to provide intelligent threat intelligence by continuously monitoring and providing protection for AWS accounts and workloads:

* IAM access to S3 buckets
* AWS accounts and Users via CloudTrail
* Kubernetes Container protection
* VPC Flow logs

There are no charges incurred during your 30 day trial period with the AWS Free Tier.

AWS GuardDuty will analyze any anomalies, identify any threats and generate a report of findings to help you remediate and prioritize any detected threats.

### Security Pillar 

The [Security Pillar](https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/welcome.html) is part of the AWS Well-Architected Framework that helps you to build AWS workloads that consider the architectural best practices to meet business and regulatory obligations.

### High Level Architecture 

The AWS GuardDuty architecture diagram, describes a workflow from the quick start initial set up through to producing report findings.

![architecture](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/iord1uvlqfq5esylpjtz.jpg)

### AWS Trusted Advisor

Is a centralized area to receive best practice recommendations for your account to help you save money and maximize the performance of your resources such as removing underutilized EC2 instances.

Recommendations focus on the areas of:

* Cost optimization
* Performance
* Security
* Fault Tolerance
* Service Limits

With an AWS Business or  Enterprise Support Plan you will receive full checks for Trusted Advisor.

### AWS Security Hub


![summary hub](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0qxq6itwgp51y9l2atse.jpg)

Provides a centralized view of insights for all of your AWS resources across multiple regions and produces findings of security alerts by providing a classification from high, medium and low risk using the services:

* Amazon GuardDuty
* Amazon Inspector
* Amazon Macie
* Amazon Trusted Advisor
* Other optional integrations

![security standards](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/flfyrk9e28vux7vyhojk.jpg)

AWS Security Hub will provide a list of security findings that you can investigate and then remediate according to best practice guidelines.


![secutity](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xx21voq7dlqad7mbjszr.jpg)

### Tutorial 1: Enabling AWS GuardDuty 

Step 1: Sign into the AWS Management console with your Admin IAM user account.

Step 2: On the search bar type 'AWS GuardDuty'

Step 3: On the AWS GuardDuty homepage click **Get Started**

![get started](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/j6osaqrdwpw78jc3v4ai.jpg)

Step 4: Click **Enable GuardDuty**


![enable guard duty](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/b8jvi8rsnempy1bulkj1.jpg)

Step 5: Enter your 12 digit AWS account number


![enter account number](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/33146q50tt3djio84y4n.jpg)

Step 6: There are no charges to AWS GuardDuty during a 30 day free trial with AWS Free Tier.

![free trialn](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/azqryw7iodcotgsjur4s.jpg)

Step 7: After AWS GuardDuty is enabled, wait for 10 minutes before you start receiving findings from GuardDuty.


![Finsings](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2g8zu5qi7cxyqpiludnv.jpg)

Step 7:  AWS GuardDuty provides S3 data protection, enables the listing of trusted IP addresses, includes a new feature for kubernetes protection and also supports AWS Organizations for your accounts.

![s3 protection](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/i3rq6rty1m9gha83533s.jpg)

### Tutorial 2: Enabling AWS Trusted Advisor

Step 1: Sign into to your AWS account using use Root account details.


![root account](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/v6m7pnu9ee87neoxiib7.jpg)

Step 2: Navigate to Amazon Trusted Advisor


![nvigate](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9ukfqq3pxe2yu1tv35bi.jpg)

Step 3:  A warning message to upgrade AWS Support Plan

You will need to upgrade your Amazon Support Plan from **Basic** to **Developer**. The Developer Support Plan will allow you to access 7 core AWS Trusted Advisor best practice recommendations on security checks and service limits.

![implement](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/brwcg3f11xqeu0jtv3yt.jpg)


![suppport plan](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/i64wg12n00sg42hfu77w.jpg)


![Idev](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tr6zf8fxz8hpnrhfs7dm.jpg)

Step 4: Select the **Developer** option to upgrade the AWS Support Plan and click **Next**.


![optionn](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ck59s2nuxxpx1koq64sb.jpg)

Step 5: You will receive a message via a pop-up window to confirm the success of AWS Trusted Advisor which has been enabled on your account.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wh6xjqiqtkqy73nu70i5.jpg)

Step 6: Wait 15 minutes to receive AWS Trusted Advisor recommendations from AWS Security Hub.

**Security checks**
![security check](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/f211hokibwmqagrgkqof.jpg)

**Service Limit checks**

![service](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6g1ipkhdqri0qwiamt6d.jpg)

![IAMn](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/py1nrn2cw3rgx9p3jy7c.jpg)

### Tutorial 3: Enabling AWS Security Hub

Please complete the steps to enable AWS Security Hub by completing the lab from the [AWS Well-Architected Labs](https://wellarchitectedlabs.com/security/100_labs/100_enable_security_hub/1_intro/)

Please refer to the [documentation](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-prereq-config.html) to troubleshoot AWS Config for AWS Security Hub.

Once AWS Security Hub is enabled, you may view insights from the dashboard for your AWS resources.


![insights](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/m81iotdkyshoiyru23bo.jpg)

### AWS re:Invent 2019: Prepare for & respond to security incidents in your AWS environment (SEC356) with Nathan Case and Paul Hawkins.

{% embed https://www.youtube.com/watch?v=8uiO0Z5meCs %}

### Join us for AWS re:Inforce conference 2022

Next week is AWS re:Inforce conference, 26-27 July 📆 

A learning conference on compliance, privacy and identity 🔐🛠️

• Register to watch the keynote & sessions streamed live online 📺 or join the AWS Community in person in Boston.

• Link: https://reinforce.awsevents.com


![Reinforce](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/sjrctympdeoqdzdir9zu.jpg)

### Hot off the press 🚀: Tutorial 4: Enabling AWS GuardDuty Malware Detection

🔒 NEW - At AWS re:Inforce 2022 the latest [announcement](https://aws.amazon.com/blogs/aws/new-for-amazon-guardduty-malware-detection-for-amazon-ebs-volumes/?sc_channel=sm&sc_campaign=AWSSecurity_Services&sc_publisher=TWITTER&sc_geo=GLOBAL&sc_outcome=adoption&trk=AWSSecurity_Services) was the release of AWS GuardDuty Malware Detection to scan an EC2 instance  or container workload.

Step 1: Navigate to your existing AWS GuardDuty dashboard start the 30 day free trial for Malware Detection.


![30](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ugylcpw1owe7y2rrwt2a.jpg)

Step 2:  Click **Enable**


![trial](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/a8fo8lgxautfpjezsxmn.jpg)

Step 3: Click **Enable Malware Protection**


![Enable Mal](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cu3bmo4iezom3v1hsu3i.jpg)

Step 4: You will receive confirmation that Malware detection was successfully created on your AWS account.


![success](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/64o1rj8b3gaqkuifnv7v.jpg)

Until the next lesson, happy learning! 🙂

### Resources

[Amazon GuardDuty](https://aws.amazon.com/guardduty/)

[AWS Security Hub](https://aws.amazon.com/security-hub/)

[AWS Trusted Advisor](https://aws.amazon.com/premiumsupport/technology/trusted-advisor/)

[Enabling and configuring AWS Security Hub](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-prereq-config.html)