- Newest
- Most votes
- Most comments
Hi, this document provide you with predefined SAM template to deploy above mentioned solution:
This recent blog post will fully detail the solution and provide all code need to implement it in your context: https://aws.amazon.com/blogs/security/using-amazon-guardduty-malware-protection-to-scan-uploads-to-amazon-s3/
Best,
Didier
Adding to this other good article, the solution sends the notifications about detected threats to EventBridge, not to SNS, so for the requested email notifications, an EventBridge rule needs to be created to send the notifications to an SNS topic. Also for clarity, this solution copies files found to be healthy to the specified destination S3 bucket, rather than moving infected files away from the source.
Thank you for the shared article. Analyzing I realize that I can get an idea and what I really need as mentioned by Leo K is that after detecting the malware in the bucket this artifact is moved to a quarantine bucket and the security team receives an email notification.
Thank you for the shared article. Analyzing I realize that I can get an idea and what I really need as mentioned by Leo K is that after detecting the malware in the bucket this artifact is moved to a quarantine bucket and the security team receives an email notification.
Hello.
When Guardduty Malware protection S3 detects malware, it tags the object.
You can trigger Lambda etc. by setting an EventBridge rule like the one below to detect that event.
{
"source": ["aws.s3"],
"detail-type": ["Object Tags Added"],
"detail": {
"bucket": {
"name": ["Your S3 Bucket Name"]
}
}
}
Alternatively, you can create event rules that notify you when threats are detected from scan results.
https://docs.aws.amazon.com/guardduty/latest/ug/monitor-with-eventbridge-s3-malware-protection.html#s3-object-scan-status-malware-protection-s3-ev
{
"detail-type": ["GuardDuty Malware Protection Object Scan Result"],
"source": ["aws.guardduty"],
"detail": {
"scanResultDetails": {
"scanResultStatus": ["THREATS_FOUND"]
}
}
}
Adding to that, the tags GuardDuty adds to the S3 object can (and arguably, should be) used only to prevent users from accessing the object both a) before the scanning has completed returned a healthy verdict and b) after the scan has detected malware. Users can be allowed only to access objects positively identified to be free of known malware.
Thank you for the shared article. Analyzing I realize that I can get an idea and what I really need as mentioned by Leo K is that after detecting the malware in the bucket this artifact is moved to a quarantine bucket and the security team receives an email notification.
Relevant content
asked 2 years ago
The solution linked is useful, but to clarify, it involves an SNS notification being sent about all completed scans (not just those involving malware detections) and the scanned object being tagged with the scanning verdict. It would need to be modified to notify only about malware detections and to move the offending objects to another bucket, to satisfy the original requirements.
Hello
Thank you for the shared article. Analyzing I realize that I can get an idea and what I really need as mentioned by Leo K is that after detecting the malware in the bucket this artifact is moved to a quarantine bucket and the security team receives an email notification.