- Newest
- Most votes
- Most comments
No, GuardDuty configures the VPC flow logs it uses, and the options for them are not configurable.
The unprotected port probes are generally a very important finding, indicating that you have SSH, RDP, MySQL, or other protocol exposed to the public internet that is an inviting target to opportunists and criminals to try to hack. You should configure your security groups to permit access to such services only from the specific IP addresses where legitimate access originates, such as your home internet IP or corporate NAT address range.
You can suppress findings automatically with suppression rules (https://docs.aws.amazon.com/guardduty/latest/ug/findings_suppression-rule.html), but in general, the default settings yield relevant findings that shouldn't be ignored or suppressed. Before making changes, I'd suggest you consider restricting access to the sensitive protocol ports by source IP, which will also cause the GuardDuty findings no longer to be generated.
Relevant content
asked 2 years ago
- AWS OFFICIALUpdated 2 years ago
- AWS OFFICIALUpdated 7 months ago
Thank you for this answer, the VPC Flow Log traffic being sent to GuardDuty is causing quite a large cost, I just want to focus on VPCs running on the production environment :(
You know your environment better than I do, of course, but in general terms, I'd expect the majority of traffic to hit the production environment. GuardDuty pricing for log analyses is based on the amount of log data processed, so if traffic volumes in the non-production VPCs is low, the GuardDuty costs would be correspondingly smaller. Technically, the way to avoid GuardDuty doing any processing at all for non-production would be for you to separate production and non-production to different AWS accounts and only enable GuardDuty for the production account.