Feature Request: GuardDuty

Question

I have been using Guardduty in our organization for few years now and when compared to other tools in the market like Google Security center etc, I believe Guard Duty is missing some of the below key functionalities , adding these functionalities will help security teams handle the findings much better and also increases the reputation of the tool as companies are investing heavily in 3rd party tools rather using the AWS inbuilt service.

1. Once a finding is generated we can only archive the finding manually , we can't change the status either to InProgress or pending or close , we have to depend on other integrations for this. Categorization is required.
2.  When a finding is generated from a certain IP address, it doesn't provide the reputation of that IP by checking in tools like Virustotal, this is also a manual task for security teams.
3. It just generates the findings and doesn't provide any detailed solutions or will not check if the security finding was actually resolved. 
Example:  A project member has unknowingly or by mistake enabled public access of an S3 bucket  a finding will be generated in Guard Duty, and when he/she was informed by security team to change the configuration from public to private and if he does so , Guardduty still doesn't know if the bucket was made private and finding was resolved.

4.  Guard Duty doesn't provide granular details like if an EC2 instance was made public it will not provide who has access to the instance and the chances of getting attacked and if it does from which geo location is the attack happening, it is a sate sponsored attack or random attack

I hope these requirements would be taken care by our AWS experts

re:Post Agent · Answer

Thank you for your feedback on Amazon GuardDuty. Let me address each of your points:

1. Regarding finding status management: GuardDuty currently focuses on detection rather than case management. While you can archive findings, GuardDuty doesn't have built-in status tracking like "In Progress" or "Pending." This is by design, as AWS Security Hub is intended to serve as the centralized platform for security finding management. Security Hub can aggregate GuardDuty findings and provides more robust case management capabilities.

2. On IP reputation information: GuardDuty is designed to detect suspicious activity based on its own threat intelligence and behavioral analysis rather than integrating with third-party reputation services like VirusTotal. This is a limitation in the current implementation.

3. Regarding resolution tracking: GuardDuty uses a finding aggregation approach where it updates existing findings with new information rather than creating new ones for the same issue. However, it doesn't automatically track remediation status. For configuration-related security issues like S3 bucket permissions, Security Hub's compliance checks would be more appropriate as they continuously evaluate resource configurations against security standards.

4. About attack context details: GuardDuty focuses on detecting specific threat patterns rather than providing comprehensive attack attribution or risk assessment. While it can identify certain types of suspicious activities, it doesn't currently provide the level of granular context you're looking for regarding attack origins or attribution.

GuardDuty is primarily a threat detection service that monitors for malicious activity and unauthorized behavior, while Security Hub is designed to provide a more comprehensive security posture management solution. For the most effective security monitoring, AWS recommends using GuardDuty in conjunction with other AWS security services like Security Hub, Amazon Detective, and AWS Config.  
**Sources**  
[Managing Amazon GuardDuty findings - Amazon GuardDuty](https://docs.aws.amazon.com/guardduty/latest/ug/findings_management.html)  
[Security Hub Findings don't match Guard Duty findings | AWS re:Post](https://repost.aws/questions/QUYqY4Jz_OTsCfztFUIjN4mQ/security-hub-findings-don-t-match-guard-duty-findings)  
[GuardDuty finding aggregation - Amazon GuardDuty](https://docs.aws.amazon.com/guardduty/latest/ug/finding-aggregation.html)  
[How to use the Amazon Detective API to investigate GuardDuty security findings and enrich data in Security Hub | AWS Security Blog](https://aws.amazon.com/blogs/security/how-to-use-the-amazon-detective-api-to-investigate-guardduty-security-findings-and-enrich-data-in-security-hub/)

Feature Request: GuardDuty

Add your answer

Relevant content