Skip to main content
Launch this lab in the IP Lab Portal, then follow the steps below in the AWS console. Open IP Lab Portal

​
Overview

​
Lab details

  1. This lab walks you through the steps to enable GuardDuty and create some sample findings.
  2. You will practice using Amazon GuardDuty.
  3. Duration: 30 minutes
  4. AWS Region: US East (N. Virginia) us-east-1

​
Introduction

​
What is AWS GuardDuty?

Amazon GuardDuty is a threat detection service that continuously monitors your AWS accounts and workloads for malicious activity and delivers detailed security findings for visibility and remediation. GuardDuty uses machine learning, anomaly detection, and threat intelligence to identify and prioritize potential threats. It can detect a wide range of threats, including:
  • Unauthorized access to your AWS resources
  • Suspicious network activity
  • Malware infections
  • Data exfiltration
  • Account takeovers
Here are some of the benefits of using Amazon GuardDuty:
  • Continuous monitoring: GuardDuty continuously monitors your AWS environment for malicious activity, 24/7. This helps you to identify threats early, before they can cause damage.
  • Detailed security findings: GuardDuty provides detailed security findings that include information about the threat, the affected resources, and recommended actions. This makes it easy to investigate and remediate threats.
  • Integration with other AWS services: GuardDuty integrates with other AWS services, such as AWS Security Hub and Amazon Detective, to help you investigate and respond to threats.
  • Cost-effective: GuardDuty is a cost-effective way to protect your AWS environment from threats. There is no upfront cost, and you only pay for the resources that you use.

​
Architecture diagram

​
Task details

  1. Sign into AWS Management Console.
  2. Enable Amazon GuardDuty**.**
  3. Explore the Amazon GuardDuty service.
  4. Generate Sample findings and understand them.
  5. Disable Amazon GuardDuty.

​
Launching the lab environment

  1. To launch the lab environment, Click on the Launch lab button.
  2. Please wait until the cloud environment is provisioned. It will take less than a minute to provision.
  3. Once the Lab is started, you will be provided with IAM user name, Password, Access Key, and Secret Access Key.
You can only start one lab at any given time

​
Lab guide

​
Lab steps

​
Task 1: Sign in to AWS Management Console

  1. Click on the Open console button, and you will get redirected to AWS Console in a new browser tab.
  2. On the AWS sign-in page,
    • Leave the Account ID as default. Never edit/remove the 12 digit Account ID present in the AWS Console. otherwise, you cannot proceed with the lab.
    • Now copy your User Name and Password in the Lab Console to the IAM Username and Password in AWS Console and click on the Sign in button.
  3. Once Signed In to the AWS Management Console, Make the default AWS Region as US East (N. Virginia) us-east-1.

​
Task 2: Enabling Amazon GuardDuty

  1. Make sure to choose the US East (N. Virginia) us-east-1 region in the AWS Management console dashboard, which is present in the top right corner.
  2. Navigate to the Services menu at the top and click on GuardDuty in the Security, Identity and Compliance section.
  3. Click on Get started.
  4. Click on Enable GuardDuty. With one click, the service will be enabled.
  5. In the Findings page, you will see the warning You don’t have any findings because there is no malicious activity happening in your AWS Account. Ignore the warnings, wherever you find.

​
Task 3: Exploring Amazon GuardDuty

Settings
  1. Click on Settings in the left panel.
  2. You will see a Detector ID. A detector is a resource that represents the GuardDuty service.
  3. Service roles: GuardDuty uses a service role to monitor your data sources on your behalf.
  4. Findings export options: Findings are automatically sent to CloudWatch Events. You can also export findings to an S3 bucket. New findings are exported within 5 minutes. No need to change anything.
  5. Suspend GuardDuty:
    • Suspend GuardDuty: When you suspend GuardDuty, it stops monitoring your AWS environment and doesn’t generate new findings. Your existing findings remain intact and aren’t affected.
    • Disable GuardDuty: When you disable GuardDuty, you not only stop GuardDuty from monitoring your AWS environment and generating new findings, you also lose your existing findings and your GuardDuty configurations. You can’t recover the data later.

​
Lists

  1. Click on Lists below Settings.
  2. In the List Manager, you can add the Trusted IP Lists and Threat IP Lists.
If the page is blank, refresh the webpage 2–3 times.
  1. Trusted IP Lists: Trusted IP lists consist of IP addresses that are whitelisted for secure communication with your AWS environment. GuardDuty does not generate findings for IP addresses that are included in trusted IP lists.
  2. Threat IP Lists: Threat lists consist of known malicious IP addresses. GuardDuty generates findings for IP addresses that are included in threat lists.

​
Accounts

  1. Click on Accounts above the settings.
  2. You can invite other accounts to enable GuardDuty and become associated with your AWS account.
  3. When an invitation is accepted, your account is designated as the master GuardDuty account.
  4. The account that accepts the invitation becomes a member account associated with your master account.
  5. You can then view and manage the GuardDuty findings on behalf of the member account. In GuardDuty, a master account (per region) can have up to 1000 member accounts.

​
Task 4: Generating Sample Findings

  1. Since there are no potential threats in our AWS Account, let us generate some sample findings and learn about them.
  2. Navigate to settings from left panel, scroll down and click on Generate sample findings.
  3. To find your sample findings, go to Findings from left panel.
  4. Wait until the loading is completed. In the top-right corner, you should see several findings.
  5. You can use filter criteria to filter your findings.
  6. Click on one of the sample findings.
  7. You can see various parameters like severity, region, Account ID, Resource ID, Resource Affected, etc.
  8. Go through the sample to learn more about the different severities.

​
Task 5: Validation of the Lab

  1. Once the labs steps are completed, please click on Check my work button on right side panel.
  2. This will validate the resources in the AWS account and displays whether you have completed this lab successfully or not.
  3. Sample Output:

​
Task 6: Disabling GuardDuty

  1. Go to the settings and click on DisableGuardDuty under suspend GuardDuty to stop it.
  2. Click on Disable to confirm.
  3. You have successfully disabled GuardDuty.
Do you know?Amazon GuardDuty analyzes and monitors billions of events across your AWS accounts, including API calls, network traffic, and DNS data, to identify potential security threats and anomalies.

​
Completion and conclusion

  1. You have successfully used the AWS management console to enable Amazon GuardDuty.
  2. You have successfully explored the options of Amazon GuardDuty Service like Settings, Lists, and Accounts.
  3. You have generated some sample findings and reviewed them.
  4. You have successfully disabled Amazon GuardDuty.

​
End lab

  1. Sign out of AWS Account.
  2. You have successfully completed the lab.
  3. Once you have completed the steps click on End lab in the IP Lab Portal.

​
What gets checked

When you press Check my work, the platform verifies each of these:
  • Check GuardDuty Findings — Check whether Amazon GuardDuty findings are present or not.
  • Enable GuardDuty — Check whether the Amazon GuardDuty service is enabled or not.