How to Integrate Amazon GuardDuty Findings with On-Premises Splunk

Step 1: Enable Amazon GuardDuty

First, ensure that GuardDuty is enabled in your AWS account. GuardDuty generates findings and sends them to Amazon CloudWatch Events (EventBridge), which can then be routed to other AWS services or directly exported to Splunk.

---

Step 2: Export GuardDuty findings

Export GuardDuty findings using one of the following approaches:

Option A: Amazon CloudWatch Events

1. Create a CloudWatch Events rule that matches GuardDuty findings.

   Event pattern example:

   {
     "source": ["aws.guardduty"],
     "detail-type": ["GuardDuty Finding"]
   }
   

2. Set the rule's target to:

   • AWS Lambda: Write a Lambda function that forwards findings to your on-prem Splunk using the HTTP Event Collector (HEC).
   • Amazon Kinesis Data Firehose: Use Firehose to stream findings to a location accessible by Splunk.

Option B: S3 Bucket

1. Configure findings to be delivered to an S3 bucket from the GuardDuty settings Findings export options.
2. Splunk can then pull findings from the bucket using the Splunk Add-on for AWS (see Step 3 for details).

---

Step 3: Configure Splunk to receive GuardDuty findings

Configure Splunk to receive GuardDuty findings using one of the following approaches.

Option A: HTTP Event Collector (HEC)

1. Enable HEC on your Splunk instance:
   • Navigate to Settings > Data Inputs > HTTP Event Collector and create a new token.
2. Write an AWS Lambda function to send findings to Splunk:
   • Use the Splunk HEC endpoint and token for authentication.
   • Format the data as JSON for easy parsing in Splunk.

Option B: Splunk Add-on for AWS

1. Install the Splunk Add-on for AWS from Splunkbase.
2. Configure the add-on to pull GuardDuty findings:
   • From S3 Buckets: Configure the S3 input to fetch findings stored in an S3 bucket.
   • From CloudWatch Logs: Use the CloudWatch Logs input if you’re using CloudWatch subscriptions.

Option C: Splunk Universal Forwarder

If findings are exported to a local directory or a shared file system accessible by Splunk, configure the Splunk Universal Forwarder to monitor the directory and forward data.

---

Step 4: Parse and analyze findings in Splunk

Once the findings are ingested, use Splunk's Field Extraction or Search Processing Language (SPL) to parse and analyze them.

Example SPL Query

index="aws_guardduty" sourcetype="aws:guardduty"
| spath input=_raw
| table accountId, region, type, severity, description, service.eventFirstSeen, resource.resourceType

---

Step 5: Validate and monitor

1. Generate sample findings in GuardDuty to verify they appear in Splunk.
2. Use Splunk’s dashboards and alerting features to monitor findings and trigger alerts for high-severity threats.

---

Tools & Resources

• Amazon GuardDuty Findings Documentation: Learn about the structure and details of GuardDuty findings.
• Amazon CloudWatch Events to Splunk Integration: AWS documentation on sending CloudWatch Events to Splunk using HTTP Event Collector.
• Splunk HTTP Event Collector (HEC) Guide: Documentation to set up and use HEC for data ingestion.
• AWS SDKs and APIs: Use these for writing custom scripts to forward GuardDuty findings.