AWS GuardDuty

Updated 1 month ago by Sachit Soni


TruSTAR is a threat intelligence platform designed to accelerate incident analysis process and exchange of intelligence among various internal and external teams. This document provides detailed instructions to setup AWS Lambda function which can listen for Guard Duty events that are triggered and send the event details into TruSTAR

TruSTAR's AWS GuardDuty Integration allows AWS users who have access to GuardDuty send GD "Findings" into their private enclaves in TruSTAR. The way the integration works is by having users send their Guard Duty Findings as events into TruSTAR. Users can create a Lambda function by importing TruSTAR’s custom script that sends findings as events in TruSTAR. This Lambda function automatically triggers every time a GD Finding is fired and submits the event into a customer specified enclave in TruSTAR.

APP Installation


The following bundles are required for successful installation of the TruSTAR AWS Guard Duty app.


Bundle Name



AWS Guard Duty App Bundle (

This bundle contains the lambda functions that a user will need to trigger Guard Duty events


AWS Instance with access to configure Lambda function

Users need to have access to configure Lambda functions in AWS to leverage the App


Create Lambda Function

  • Navigate to Lambda →  Create Function
  • Fill out the details, refer to image below
    • Name – Unique name to identify Lambda function
    • Runtime – Select Python 2.7
    • Role – Select a role which has access to “AWS CloudWatch Logs”
  • Select create function
  • Select “Upload a zip file” in Function code and upload the zip bundle(
  • Enter the environment variables
    • TRUSTAR_URL – TruStar Station URL (Ensure it doesn’t have trailing ‘/’)

    • API_KEY – TruStar API Key

    • API_SECRET – TruStar API Secret
    • ENCLAVE_ID – TruStar Enclave Id

  • Change the timeout to 2 mins
  • Save the changes

Create CloudWatch Event

  • Create a CloudWatch Event Rule
  • Navigate Services --> Management Tools --> Cloud Watch
  • Click on Rules --> Create Rule ; select the details
  • Add the Target and select the Lambda function refer to image below
  • Click on configure details
  • Add the name of configure rule details and Create rule.
  • Select create rule

Sample JSON Event Ingested into TruSTAR

            "version": "0",
            "id": "c8c4daa7-a20c-2f03-0070-b7393dd542ad",
            "detail-type": "GuardDuty Finding",
            "source": "aws.guardduty",
            "account": "123456789012",
            "time": "1970-01-01T00:00:00Z",
            "region": "us-east-1",
            "resources": [],
            "detail": {
              "schemaVersion": "2.0",
              "accountId": "123456789012",
              "region": "us-east-1",
              "partition": "aws",
              "id": "99afba5c5c43e07c9e3e5e2e544e95df",
              "arn": "arn:aws:guardduty:us-east-1:123456789012:detector/123456789012/finding/16afba5c5c43e07c9e3e5e2e544e95df",
              "type": "99:EC2/Stateless.IntegTest",
              "resource": {
                "resourceType": "Instance",
                "instanceDetails": {
                  "instanceId": "i-05746eb48123455e0",
                  "instanceType": "t2.micro",
                  "launchTime": 1492735675000,
                  "productCodes": [],
                  "networkInterfaces": [
                      "ipv6Addresses": [],
                      "privateDnsName": "",
                      "privateIpAddress": "",
                      "privateIpAddresses": [
                          "privateDnsName": "",
                          "privateIpAddress": ""
                      "subnetId": "subnet-d58b7123",
                      "vpcId": "vpc-34865123",
                      "securityGroups": [
                          "groupName": "launch-wizard-1",
                          "groupId": "sg-9918a123"
                      "publicDnsName": "",
                      "publicIp": ""
                  "tags": [
                      "key": "Name",
                      "value": "ssh-22-open"
                  "instanceState": "running",
                  "availabilityZone": "us-east-1b",
                  "imageId": "ami-4836a123",
                  "imageDescription": "Amazon Linux AMI 2017.03.0.20170417 x86_64 HVM GP2"
              "service": {
                "serviceName": "guardduty",
                "detectorId": "3caf4e0aaa46ce4ccbcef949a8785353",
                "action": {
                  "actionType": "NETWORK_CONNECTION",
                  "networkConnectionAction": {
                    "connectionDirection": "OUTBOUND",
                    "remoteIpDetails": {
                      "ipAddressV4": "",
                      "organization": {
                        "asn": -1,
                        "isp": "GeneratedFindingISP",
                        "org": "GeneratedFindingORG"
                      "country": {
                        "countryName": "United States"
                      "city": {
                        "cityName": "GeneratedFindingCityName"
                      "geoLocation": {
                        "lat": 0,
                        "lon": 0
                    "remotePortDetails": {
                      "port": 22,
                      "portName": "SSH"
                    "localPortDetails": {
                      "port": 2000,
                      "portName": "Unknown"
                    "protocol": "TCP",
                    "blocked": false
                "resourceRole": "TARGET",
                "additionalInfo": {
                  "unusualProtocol": "UDP",
                  "threatListName": "GeneratedFindingCustomerListName",
                  "unusual": 22
                "eventFirstSeen": "2017-10-31T23:16:23Z",
                "eventLastSeen": "2017-10-31T23:16:23Z",
                "archived": false,
                "count": 1
              "severity": 5,
              "createdAt": "2017-10-31T23:16:23.824Z",
              "updatedAt": "2017-10-31T23:16:23.824Z",
              "title": "99:EC2/Stateless.IntegTest",
              "description": "99:EC2/Stateless.IntegTest"


Known Limitations

  • There is a known limitation in AWS Guard Duty app where

Please reach out to for any additional questions.

How Did We Do?