Rule: GuardDuty should be enabled

Rule Description:

Troubleshooting Steps:

2. 1.

   Ensure correct AWS region: Check if you are in the correct AWS region where you want to enable GuardDuty. GuardDuty is region-specific, so it must be enabled in each desired AWS region independently.

4. 2.

   Verify IAM permissions: Ensure that the AWS Identity and Access Management (IAM) user or role you are using to enable GuardDuty has the necessary permissions. The required permissions include:

   • guardduty:CreateDetector

     - to create a GuardDuty detector

   • guardduty:EnableOrganizationAdminAccount

     - to enable GuardDuty in the organization's AWS accounts, if applicable

   • guardduty:CreatePublishingDestination

     - to create publishing destinations for findings

   • guardduty:UpdateOrganizationConfiguration

     - to manage AWS Organization configuration for GuardDuty, if applicable
6. 3.

   Check GuardDuty status: Once GuardDuty is enabled, check the status of GuardDuty for NIST 800-53 Revision 5 compliance. The guardduty:Creating, guardduty:Enabled, and guardduty:Disabled states are possible.

   • Use the AWS Command Line Interface (CLI) command:

     aws guardduty list-detectors

     to list the detectors and check the status.

Necessary Codes:

Step-by-Step Guide for Remediation:

2. 1.

   Sign in to the AWS Management Console: Access the AWS Management Console using your account credentials.

4. 2.

   Open GuardDuty: In the AWS Management Console, navigate to the GuardDuty service. You can find it under the "Security, Identity & Compliance" category or by searching for "GuardDuty" in the search bar.

6. 3.

   Select the desired region: Ensure you are in the correct AWS region where you want to enable GuardDuty. If needed, switch to the desired region from the region selector in the AWS Management Console.

8. 4.

   Create a detector: Click on the "Create detector" button to create a new GuardDuty detector. You can choose the existing master account or create a new one.

10. 5.

    Enable GuardDuty: After creating the detector, click on the "Enable GuardDuty" button to enable GuardDuty for the selected region. Review the settings and click "Enable GuardDuty" again to confirm.

12. 6.

    (Optional) Enable GuardDuty for the organization: If you want to enable GuardDuty for the entire AWS Organization, click on "Enable" next to "Enable GuardDuty for my organization" and follow the prompts.

14. 7.

    Review status: Once GuardDuty is enabled, review the status and ensure it is in the enabled state for NIST 800-53 Revision 5 compliance. GuardDuty will start monitoring for threats based on its default setting and configuration.