Enable GuardDuty Rule

Rule Description:

Remediation Steps:

Step 1: Enable GuardDuty

2. 1.

   Log in to the AWS Management Console.

4. 2.

   Navigate to the GuardDuty service.

   Note: If you have not enabled GuardDuty before, you may need to follow the on-screen prompts to set it up.

6. 3.

   Click on "Enable GuardDuty" to enable it for your AWS account.

Step 2: Configure GuardDuty for NIST 800-171 Revision 2

2. 1.

   In the GuardDuty console, click on "Findings" in the left-hand menu.

4. 2.

   Click on "Create filter" to set up a filter for NIST 800-171 Revision 2.

   Note: Filters help you focus on specific types of findings based on severity, resource type, or other properties.

6. 3.

   In the "Create filter" dialog, configure the following settings:

   • Filter name: Provide a descriptive name for the filter (e.g., NIST 800-171).

   • Filter type: Select "Custom"

   • Filter criteria: Set the criteria to meet the requirements of NIST 800-171 Revision 2. This may include specific keywords, patterns, or attributes associated with the NIST controls.

   Note: Consult the NIST 800-171 Revision 2 documentation to identify the specific controls and requirements you need to address.

8. 4.

   Click on "Save filter" to save the filter configuration.

Step 3: Configure GuardDuty Actions

2. 1.

   In the GuardDuty console, click on "Findings" in the left-hand menu.

4. 2.

   Click on "Actions" and then "Manage actions" to define the response actions for GuardDuty findings.

   Note: Response actions are triggered based on the severity and category of findings detected by GuardDuty.

6. 3.

   Configure the appropriate response actions for NIST 800-171 Revision 2 findings. This may include sending notifications, creating CloudWatch Events, or triggering Lambda functions to remediate specific issues.

   Note: Ensure that the response actions align with the requirements and recommendations of NIST 800-171 Revision 2.

Step 4: Monitor GuardDuty Findings

2. 1.

   In the GuardDuty console, click on "Findings" in the left-hand menu.

4. 2.

   Review the findings generated by GuardDuty regularly to identify any potential security risks or unauthorized activities.

   Note: GuardDuty provides a dashboard, real-time alerts, and detailed reports to help you analyze and respond to findings effectively.

6. 3.

   Investigate any findings related to NIST 800-171 Revision 2 and take appropriate actions to mitigate the risks or address non-compliance.

Troubleshooting Steps:

2. 1.
   Verify that GuardDuty is enabled for your AWS account and properly configured.
4. 2.
   Check the filter configuration for NIST 800-171 Revision 2 to ensure it aligns with the specific requirements and controls.
6. 3.
   Review the GuardDuty actions and make sure they are correctly set up to respond to findings related to NIST 800-171 Revision 2.
8. 4.
   Confirm that you have access to the appropriate resources, services, and permissions required for GuardDuty to function effectively.
10. 5.
    If the troubleshooting steps above do not resolve the issue, consult the AWS documentation or contact AWS Support for further assistance.

Relevant Codes (if applicable):

References: