Best method to send guardduty logs to opensearch

0

What is the best method to send guardduty logs to opensearch service. ? Cloud watch or through S3+lambda? Which is more efficient and cost effective? Thanks

2개 답변
1

AWS has an opensource solution that helps you set up OpenSearch: https://github.com/aws-samples/siem-on-amazon-opensearch-service. After the initial set up of opensearch, you will then follow these steps to configure GuardDuty findings to be sent to the opensearch instance: https://github.com/aws-samples/siem-on-amazon-opensearch-service/blob/main/docs/configure_aws_service.md#Amazon-GuardDuty

AWS
답변함 일 년 전
0

Stepping back a bit, what are you trying to do with this data? Are you trying to setup alerts? A dashboard of some kind? Or integrate with a 3rd party SIEM solution? In order to try to minimize back and forth, I will provide a solution to several of these use-cases, please let me know if any of these hit the mark.

  1. Alerts: You can create a CloudWatch event from Guard Duty findings and create an alert for them as documented here.
  2. Dashboard: Amazon Guard Duty integrates with AWS Security Hub, which provides you with a comprehensive view of your security state in AWS. Findings from Guard Duty flow over to Security Hub, which provides you with a simple workflow management interface for all findings across all services. More info here. However, strictly speaking Security Hub is not a SIEM, which leads to...
  3. 3rd party integration: Most 3rd party SIEM solutions integrate with Security Hub, so any and all findings from Security Hub, including those from Guard Duty, can flow over to your SIEM of choice.

Do any of these address your particular use case?

profile pictureAWS
답변함 2년 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠