AWS GuardDuty
Introduction
TruSTAR is a threat intelligence platform designed to accelerate incident analysis process and exchange of intelligence among various internal and external teams. This document provides detailed instructions to setup AWS Lambda function which can listen for Guard Duty events that are triggered and send the event details into TruSTAR
TruSTAR's AWS GuardDuty Integration allows AWS users who have access to GuardDuty send GD "Findings" into their private enclaves in TruSTAR. The way the integration works is by having users send their Guard Duty Findings as events into TruSTAR. Users can create a Lambda function by importing TruSTAR’s custom script that sends findings as events in TruSTAR. This Lambda function automatically triggers every time a GD Finding is fired and submits the event into a customer specified enclave in TruSTAR.
APP Installation
Prerequisites
The following bundles are required for successful installation of the TruSTAR AWS Guard Duty app.
# | Bundle Name | Description |
1 | AWS Guard Duty App Bundle (GD-Station-Lambda.zip) | This bundle contains the lambda functions that a user will need to trigger Guard Duty events |
2 | AWS Instance with access to configure Lambda function | Users need to have access to configure Lambda functions in AWS to leverage the App |
Installation
Create Lambda Function
- Navigate to Lambda → Create Function
- Fill out the details, refer to image below
- Name – Unique name to identify Lambda function
- Runtime – Select Python 2.7
- Role – Select a role which has access to “AWS CloudWatch Logs”
- Select create function
- Select “Upload a zip file” in Function code and upload the zip bundle(GD-Station-Lambda.zip)
- Enter the environment variables
- TRUSTAR_URL – TruStar Station URL (Ensure it doesn’t have trailing ‘/’)
- API_KEY – TruStar API Key
https://station.trustar.co/settings/api
- API_SECRET – TruStar API Secret
- ENCLAVE_ID – TruStar Enclave Id
https://station.trustar.co/settings/profile
- Change the timeout to 2 mins
- Save the changes
Create CloudWatch Event
- Create a CloudWatch Event Rule
- Navigate Services --> Management Tools --> Cloud Watch
- Click on Rules --> Create Rule ; select the details
- Add the Target and select the Lambda function refer to image below
- Click on configure details
- Add the name of configure rule details and Create rule.
- Select create rule
Sample JSON Event Ingested into TruSTAR
{
"version": "0",
"id": "c8c4daa7-a20c-2f03-0070-b7393dd542ad",
"detail-type": "GuardDuty Finding",
"source": "aws.guardduty",
"account": "123456789012",
"time": "1970-01-01T00:00:00Z",
"region": "us-east-1",
"resources": [],
"detail": {
"schemaVersion": "2.0",
"accountId": "123456789012",
"region": "us-east-1",
"partition": "aws",
"id": "99afba5c5c43e07c9e3e5e2e544e95df",
"arn": "arn:aws:guardduty:us-east-1:123456789012:detector/123456789012/finding/16afba5c5c43e07c9e3e5e2e544e95df",
"type": "99:EC2/Stateless.IntegTest",
"resource": {
"resourceType": "Instance",
"instanceDetails": {
"instanceId": "i-05746eb48123455e0",
"instanceType": "t2.micro",
"launchTime": 1492735675000,
"productCodes": [],
"networkInterfaces": [
{
"ipv6Addresses": [],
"privateDnsName": "ip-172-31-36-156.us-east-1.compute.internal",
"privateIpAddress": "172.31.36.156",
"privateIpAddresses": [
{
"privateDnsName": "ip-172-31-36-156.us-east-1.compute.internal",
"privateIpAddress": "172.31.36.156"
}
],
"subnetId": "subnet-d58b7123",
"vpcId": "vpc-34865123",
"securityGroups": [
{
"groupName": "launch-wizard-1",
"groupId": "sg-9918a123"
}
],
"publicDnsName": "ec2-11-111-111-1.us-east-1.compute.amazonaws.com",
"publicIp": "11.111.111.1"
}
],
"tags": [
{
"key": "Name",
"value": "ssh-22-open"
}
],
"instanceState": "running",
"availabilityZone": "us-east-1b",
"imageId": "ami-4836a123",
"imageDescription": "Amazon Linux AMI 2017.03.0.20170417 x86_64 HVM GP2"
}
},
"service": {
"serviceName": "guardduty",
"detectorId": "3caf4e0aaa46ce4ccbcef949a8785353",
"action": {
"actionType": "NETWORK_CONNECTION",
"networkConnectionAction": {
"connectionDirection": "OUTBOUND",
"remoteIpDetails": {
"ipAddressV4": "198.51.100.0",
"organization": {
"asn": -1,
"isp": "GeneratedFindingISP",
"org": "GeneratedFindingORG"
},
"country": {
"countryName": "United States"
},
"city": {
"cityName": "GeneratedFindingCityName"
},
"geoLocation": {
"lat": 0,
"lon": 0
}
},
"remotePortDetails": {
"port": 22,
"portName": "SSH"
},
"localPortDetails": {
"port": 2000,
"portName": "Unknown"
},
"protocol": "TCP",
"blocked": false
}
},
"resourceRole": "TARGET",
"additionalInfo": {
"unusualProtocol": "UDP",
"threatListName": "GeneratedFindingCustomerListName",
"unusual": 22
},
"eventFirstSeen": "2017-10-31T23:16:23Z",
"eventLastSeen": "2017-10-31T23:16:23Z",
"archived": false,
"count": 1
},
"severity": 5,
"createdAt": "2017-10-31T23:16:23.824Z",
"updatedAt": "2017-10-31T23:16:23.824Z",
"title": "99:EC2/Stateless.IntegTest",
"description": "99:EC2/Stateless.IntegTest"
}
}
Troubleshooting
Known Limitations
- There is a known limitation in AWS Guard Duty app where
Please reach out to support@trustar.co for any additional questions.
