Rule: GuardDuty findings should be archived

GuardDuty Findings Archival for NIST 800-53 Revision 4

Rule Description:

Troubleshooting Steps:

2. 1.
   Check if GuardDuty is enabled on your AWS account.
4. 2.
   Ensure that you have the necessary permissions to configure GuardDuty and access the associated S3 bucket for archival.
6. 3.
   Verify that an S3 bucket is available for storing the archived GuardDuty findings. If not, create a new S3 bucket for this purpose.

Code (AWS CLI commands):

Step 1: Enable GuardDuty (if not already enabled)

$ aws guardduty create-detector --enable

Step 2: Create an S3 bucket for archival

$ aws s3api create-bucket --bucket <bucket-name> --region <region>

Step 3: Configure GuardDuty to archive findings to S3 bucket

$ aws guardduty update-configuration --detector-id <detector-id> --finding-publishing-frequency BATCH --data-sources.s3Logs.enabled true --data-sources.s3Logs.s3BucketArn arn:aws:s3:::<bucket-name>

<bucket-name>

<region>

<detector-id>

Remediation Steps:

2. 1.

   Enable GuardDuty:

   • Execute the AWS CLI command mentioned in Step 1 to enable GuardDuty on your AWS account.
4. 2.

   Create an S3 bucket:

   • Execute the AWS CLI command mentioned in Step 2 to create an S3 bucket for storing the archived findings.
   • Note the name of the bucket for further steps.
6. 3.

   Configure GuardDuty to archive findings:

   • Execute the AWS CLI command mentioned in Step 3, replacing

     <bucket-name>

     and

     <detector-id>

     with the appropriate values.
   • This command ensures that findings are published to the specified S3 bucket with the desired frequency.
8. 4.

   Verification:

   • Ensure that GuardDuty findings are being successfully archived by monitoring the S3 bucket for new findings files.
   • Review the contents of the findings files to verify that important security incidents are being captured.