AWS GuardDuty Integration

Overview

Amazon GuardDuty is a threat detection service that continuously monitors your AWS accounts and workloads for malicious activity and anomalous behavior. This integration consumes GuardDuty findings via Amazon EventBridge, enabling autobotAI to power automated threat response workflows and incident remediation.

GuardDuty analyzes data from multiple AWS sources including AWS CloudTrail event logs, VPC Flow Logs, DNS logs, Amazon S3 data events, EKS audit logs, and runtime activity to identify threats such as compromised instances, unauthorized access, and data exfiltration.

By using the listener integration with AWS GuardDuty, you can:

• Receive real-time threat detection findings from Amazon GuardDuty
• Create automated response workflows for security incidents
• Integrate GuardDuty findings with your existing automation pipelines
• Monitor threat posture across your AWS environment in a unified dashboard

GuardDuty Finding Types

Amazon GuardDuty generates findings across several threat categories:

• EC2 Finding Types: Compromised instances, cryptocurrency mining, command and control activity, denial of service, unauthorized access, data exfiltration
• IAM Finding Types: Compromised credentials, anomalous API calls, unusual console logins, unauthorized policy changes
• S3 Finding Types: Unusual data access patterns, disabled logging, exposed buckets, policy changes
• Kubernetes Finding Types: Suspicious container activity, privilege escalation, anonymous access, exposed dashboards
• Runtime Monitoring Finding Types: Malicious file downloads, suspicious process execution, reverse shells, privilege escalation at the OS level
• Malware Protection Finding Types: Malware detected on EC2 instances or in EBS volumes

Each finding includes severity ratings (Critical, High, Medium, Low), threat purpose, affected resources, and recommended remediation actions.

Value Add for GuardDuty Customers

When you connect AWS GuardDuty to autobotAI, findings are not only collected but also prioritized and automatically remediated through bots and workflows. autobotAI can, for example:

• Quarantine compromised EC2 instances by isolating them into restrictive security groups
• Disable compromised IAM credentials automatically
• Block malicious IP addresses across security groups and NACLs
• Revoke unauthorized S3 bucket public access
• Terminate cryptocurrency mining instances
• Contain compromised Kubernetes pods and workloads
• Open incident tickets in your ITSM when high-severity threats are detected
• Trigger custom remediation playbooks based on finding type and severity

This gives customers a real-time, automated response layer on top of Amazon GuardDuty, reducing Mean Time to Detect (MTTD) and Mean Time to Remediate (MTTR).

Prerequisites

Before setting up the AWS GuardDuty integration, ensure you have:

1. Active AWS Account

   • An active AWS account with GuardDuty enabled in your region
   • GuardDuty already configured and monitoring your workloads

2. autobotAI Account

   • A registered autobotAI account
   • Admin or Editor permissions to create listeners

3. GuardDuty Enabled

   • GuardDuty enabled in your AWS account
   • Data sources (CloudTrail, VPC Flow Logs, DNS logs) actively being analyzed

Architecture

The integration uses AWS EventBridge to securely forward GuardDuty findings to autobotAI:

Amazon GuardDuty → EventBridge Rule → API Destination → autobotAI Listener

Components:

• EventBridge Rule: Filters and forwards GuardDuty findings
• API Destination: Secure endpoint for receiving findings
• Connection: API key authentication between AWS and autobotAI
• autobotAI Listener: Receives and processes incoming findings

Delegated Admin and Multi-Account

If you are using a GuardDuty delegated administrator account and aggregating findings across your AWS Organization, deploy the EventBridge rule only in the delegated admin account's region. All aggregated GuardDuty findings flow to that account, ensuring autobotAI receives findings from every member account without per-account or per-region rules.

Multi-Region Consideration

GuardDuty operates independently in each AWS region. If you have GuardDuty enabled in multiple regions, you must either:

• Deploy the EventBridge rule in each region where GuardDuty is active, or
• Use GuardDuty's cross-region findings aggregation (if using a delegated admin) to consolidate findings into a single region

Setup Instructions

Step 1: Create a GuardDuty Listener in autobotAI

1. Navigate to Listeners

   • Go to the autobotAI dashboard
   • Click on "Bot Building Blocks" → "Listeners"

2. Create New Listener

   • Click on "+ New" to create a new listener

3. Configure Listener Details

   • Name: Give your listener a descriptive name (e.g., "AWS GuardDuty Findings")
   • Description: Add a brief description for reference
   • Authentication Method: Select Secret Key in Headers
   • Click on "Next"

4. Generate Authentication

   • autobotAI will automatically generate a unique Listener URL and Secret Key
   • Click "Generate" if needed

5. Important: Save Your Credentials

   • Copy both the Listener URL and Secret Key
   • Store these securely - they will be needed for AWS configuration

Step 2: Deploy CloudFormation Template

Follow these steps to deploy the integration using the provided CloudFormation template.

1. Download the Template

   • Download the autobotAI GuardDuty CloudFormation template: autobotAI-GuardDuty-EventBridge.yml
   • Save the file to your local machine.

2. Open CloudFormation Console

   • Go to the AWS CloudFormation console in your preferred region.
   • Click "Create stack" and select "With new resources (standard)".

3. Specify template source

   • Select "Upload a template file".
   • Click "Choose file" and select the autobotAI-GuardDuty-EventBridge.yml file you downloaded in step 1.
   • Click "Next".

4. Provide stack name

   • Stack name: autobotAI-GuardDuty-EventBridge

5. Configure stack parameters

   • APIEndPoint: Your autobotAI listener URL (from Step 1)
   • APIKeyName: x-secret-key (default)
   • APIKeyValue: Your autobotAI secret key (from Step 1)

6. Configure capabilities

   • Click "Next"
   • Enable the required capabilities:
     • IAM Permissions: AWS Auto Scaling creates IAM resources
     • CAPABILITY_IAM (if it prompts)

7. Configure stack options (optional)

   • Review advanced settings if needed
   • Keep defaults for most scenarios

8. Create and monitor

   • Check the Capabilities checkbox at the bottom and click on "Next"
   • Click on "Submit"
   • Wait for deployment (typically 1-3 minutes)
   • Monitor progress in the "Stack operations" tab

9. Verify successful deployment

   • Check that stack status shows "CREATE_COMPLETE"
   • Review the created resources in the "Resources" tab
   • Note the ARNs for troubleshooting if needed

Optional: Manual EventBridge Rule Creation (Console)

If you prefer not to use CloudFormation, you can create the EventBridge rule manually:

1. Go to the Amazon EventBridge console and choose Rules → Create rule.

2. Set a rule name, for example autobotAI-GuardDuty-Findings.

3. For Event source, choose AWS events or EventBridge partner events.

4. For Event pattern, select Event pattern form and configure:

   • Event source: AWS services
   • Service name: GuardDuty
   • Event type: GuardDuty Finding

5. Alternatively, use Custom pattern (JSON editor) with:

   json
   {
     "source": ["aws.guardduty"],
     "detail-type": ["GuardDuty Finding"]
   }

6. To filter by severity (e.g., only High and Critical findings), use:

   json
   {
     "source": ["aws.guardduty"],
     "detail-type": ["GuardDuty Finding"],
     "detail": {
       "severity": [{ "numeric": [">=", 7] }]
     }
   }

   GuardDuty severity ranges: Low (1.0-3.9), Medium (4.0-6.9), High (7.0-8.9), Critical (9.0-10.0).

7. For Target, select API destination and choose the destination created for your autobotAI listener (or create a new API destination using the listener URL and secret key provided in Step 1).

8. Configure the API destination (if creating new):

   • Name: autobotAI-GuardDuty-Listener
   • API destination endpoint: Your autobotAI listener URL
   • HTTP method: POST
   • Connection: Create new connection with API key authorization using your autobotAI secret key

9. Save the rule and ensure its state is ENABLED.

For detailed steps on creating API destinations, see the Amazon EventBridge API Destinations documentation.

Step 3: Verify Integration

1. Check EventBridge Rule

   • Go to AWS EventBridge console
   • Find the rule named autobotAI-GuardDuty-Findings
   • Verify it's enabled and targeting your API destination

2. Test GuardDuty Findings

   • Use the GuardDuty console to generate sample findings:
     • Navigate to GuardDuty → Settings → Generate sample findings
     • This creates sample findings for testing without requiring actual threats
   • Wait a few minutes for the findings to be forwarded

3. Verify in autobotAI

   • Go to your listener in autobotAI
   • Click "Test" to view recent events
   • You should see GuardDuty finding data being received

CloudFormation Template

The integration uses the following CloudFormation template:

Template URL:

https://autobot-ai.s3.amazonaws.com/autobotAI-GuardDuty-EventBridge.yml

Template Components:

EventBridge API Destination

Forwards GuardDuty findings to your autobotAI listener endpoint

Properties:

• Name: autobotAI-guardduty-listener-webhook
• Invocation Endpoint: Your listener URL
• HttpMethod: POST
• Rate Limit: 300 invocations per second
• Authorization: API key authentication

EventBridge Connection

Establishes secure connection to your autobotAI listener

Properties:

• Name: autobotAI-guardduty-listener-connection
• Authorization Type: API_KEY
• API Key Name: x-secret-key
• API Key Value: Your listener secret

IAM Roles and Policies

Grants EventBridge permission to invoke your API destination

Resources:

• IAM Role: autobotAI_EventBridge_GuardDuty_Invoke_Api_Destination
• Managed Policy: autobotAI_EventBridge_GuardDuty_Invoke_Api_Destination_Policy

EventBridge Rule

Filters and forwards GuardDuty findings

Event Pattern:

• Source: aws.guardduty
• Detail Type: GuardDuty Finding
• AWS Account ID: Your account ID
• State: Enabled

Security Considerations

Authentication

• API Key Authentication: Uses header-based authentication
• Secret Key Protection: Treat your secret key as sensitive data
• HTTPS Only: All communication uses HTTPS for encryption

Data Privacy

• Findings remain in your AWS account until forwarded
• No data is stored on autobotAI servers
• You maintain full control over your GuardDuty data

Access Control

• Only your AWS account can configure the EventBridge rule
• The CloudFormation stack requires appropriate IAM permissions
• Review IAM roles to ensure least privilege access

Troubleshooting

Stack Creation Fails

Problem: CloudFormation stack fails to create

Solutions:

1. IAM Permissions: Ensure you have permission to create EventBridge resources
2. Region: Verify GuardDuty is enabled in the same region as deployment
3. Limit Exceeded: Check AWS service quotas for EventBridge resources
4. Network: Ensure outbound HTTPS connectivity to autobotAI

No Findings Received

Problem: GuardDuty findings not appearing in autobotAI

Troubleshooting Steps:

1. Check EventBridge Rule Status

   • Go to AWS EventBridge console
   • Verify rule is enabled and rule state is "ENABLED"
   • Check rule's event pattern matches your findings

2. Verify API Destination

   • Check that the API destination exists and is healthy
   • Test the endpoint manually using curl or Postman
   • Verify the URL and secret key are correct

3. Check Listener Status

   • Confirm your listener in autobotAI is active
   • Click "Test" to view listener activity
   • Check for any authentication errors

4. Review CloudWatch Logs

   • Check EventBridge rule delivery logs
   • Look for API destination invocation failures
   • Verify Lambda execution logs (if applicable)

5. Generate Sample Findings

   • Use GuardDuty's built-in sample finding generator
   • Navigate to GuardDuty → Settings → Generate sample findings
   • Verify sample findings are forwarded to autobotAI

Findings Not Matching Event Pattern

Problem: EventBridge rule not matching your GuardDuty findings

Solutions:

1. Verify Event Pattern

   • Check actual finding structure in the GuardDuty console
   • Confirm source and detail type values match exactly

2. Check Severity Filter

   • If you applied a severity filter, verify the numeric threshold
   • GuardDuty severity is a float between 1.0 and 10.0
   • Ensure your filter range includes the desired severity levels

3. Review Finding State

   • GuardDuty findings must be in ACTIVE state to trigger the rule
   • Archived findings do not generate new EventBridge events

Best Practices

Threat Detection Management

1. Enable All Protection Plans

   • Activate S3 Protection for data access monitoring
   • Enable EKS Protection for Kubernetes threat detection
   • Turn on Malware Protection for EC2 and EBS scanning
   • Enable Runtime Monitoring for OS-level threat detection
   • Activate RDS Protection for database login activity monitoring

2. Configure Automated Remediation

   • Set up automated instance isolation for compromised EC2 instances
   • Configure automatic credential revocation for compromised IAM users
   • Implement network-level blocking for malicious IPs

3. Regular Review Schedule

   • Review findings daily for high-severity threats
   • Analyze trends weekly to identify persistent threats
   • Prioritize findings based on severity and business impact

autobotAI Workflow Optimization

1. Create Dedicated Bots

   • Build specific bots for common GuardDuty finding types
   • Automate responses for frequent threat patterns (e.g., cryptocurrency mining, brute force)

2. Configure Alerting

   • Set up immediate notification rules for critical and high-severity findings
   • Integrate with incident management systems (PagerDuty, ServiceNow, Jira)

3. Severity-Based Routing

   • Route critical findings to automated remediation bots
   • Route medium findings to approval workflows
   • Route low findings to weekly review dashboards

4. Monitor Performance

   • Track listener response times
   • Optimize bot workflows for efficient processing

Cost Management

1. EventBridge Pricing

   • Monitor EventBridge rule executions
   • Set budget alerts for API destination costs

2. GuardDuty Costs

   • Review GuardDuty pricing for each protection plan
   • Monitor analyzed event volume per data source
   • Use severity-based filtering to reduce event volume if needed

3. autobotAI Usage

   • Monitor workflow execution costs
   • Review listener event volume for cost optimization

Supported GuardDuty Findings

The integration supports GuardDuty findings with the following event pattern:

Source: aws.guardduty

Detail Type: GuardDuty Finding

Finding Fields:

• Account ID
• Region
• Finding ID
• Type (e.g., UnauthorizedAccess:EC2/MaliciousIPCaller.Custom)
• Title
• Description
• Severity (numeric 1.0-10.0)
• Confidence
• Created At
• Updated At
• Resource (affected AWS resource details)
• Service (action details, evidence, additional information)
  • Action (network connection, API call, DNS request, port probe details)
  • Evidence (threat intelligence details)
  • Additional Info (unusual behavior, threat purpose)
• Threat Intelligence Details (threat list name, IP addresses, domain names)

Common Finding Type Categories

Next Steps

Create Threat Response Workflows

1. Build Bots for Findings

   • Create bots to analyze incoming GuardDuty findings
   • Implement automated containment actions (isolation, credential revocation, IP blocking)

2. Set Up Approval Workflows

   • Configure approval chains for critical remediation actions
   • Implement escalation policies for unresolved threats

3. Integration with Other Tools

   • Connect to incident management systems
   • Integrate with threat intelligence platforms
   • Feed findings into your SIEM for correlation with other security events

Monitor and Optimize

1. Setup Dashboards

   • Create visualizations for GuardDuty findings by severity, type, and resource
   • Build alerting and reporting dashboards

2. Regular Audits

   • Review GuardDuty findings daily for active threats
   • Analyze threat trends and identify attack patterns
   • Continuously improve detection and response posture

3. Documentation

   • Maintain detailed records of threat responses
   • Document successful containment and remediation strategies
   • Share lessons learned with security and incident response teams

Support and Resources

AWS Documentation

• Amazon GuardDuty Documentation
• GuardDuty Finding Types
• AWS EventBridge Documentation
• CloudFormation Documentation

autobotAI Resources

• Listener Documentation
• Bot Building Guide
• Security Violation Insights

Additional Help

• Contact autobotAI support for integration issues
• Review CloudFormation template documentation
• Check AWS CloudFormation service limits

Migration from Existing Integrations

If you have existing GuardDuty integration patterns, consider migrating to this architecture for:

1. Centralized Management: All GuardDuty findings processed through autobotAI
2. Automated Workflows: Built-in bot creation from findings
3. Unified Dashboard: Single view of all threat detection events
4. Improved Security: API key authentication and encrypted communication

Migration Steps:

1. Create new listener in autobotAI
2. Deploy CloudFormation stack
3. Update security policies to reference new listener URL
4. Decommission old integration endpoints
5. Test end-to-end functionality

Need Help? If you encounter any issues during setup, contact autobotAI support with:

• CloudFormation stack status
• GuardDuty finding samples
• EventBridge rule logs