AWS Details Ways to Customize GuardDuty Detections and Investigations

Article Details

Defense Focus

Reduce alert fatigue by tailoring GuardDuty detections to account and workload context, routing expected findings out of analyst queues, and accelerating investigation of findings that remain.

Detection Methods

• Evaluate opt-in Custom Detection Rules against CloudTrail management events and, when Runtime Monitoring is enabled, runtime events; use dry-run metrics to assess matches before generating findings.
• Match threat entity list entries against CloudTrail, VPC Flow Logs, Route 53 Resolver DNS query log findings, and runtime executable hashes.
• Use narrowly scoped suppression filters, including wildcard criteria and finding fields such as Kubernetes namespace, runtime process details, and network connection information.
• Correlate a finding with related activity from the preceding 90 days, affected resources, threat intelligence, and threat indicators through GuardDuty Investigation.

Data Sources

• AWS CloudTrail management events
• Amazon VPC Flow Logs
• Amazon Route 53 DNS query logs and Route 53 Resolver DNS query log findings
• GuardDuty Runtime Monitoring events from the GuardDuty security agent
• GuardDuty findings and related activity from the preceding 90 days
• Threat intelligence and threat indicators

Rule Types

• SQL-condition-based Custom Detection Rules
• Dry-run and live detection rule configurations
• Suppression filters with Matches and NotMatches wildcard criteria
• Threat entity lists containing IP addresses, CIDR ranges, domain names, and SHA-256 file hashes

Platforms

• AWS accounts and multi-account organizations
• Kubernetes workloads

Defensive Actions

• Start Custom Detection Rules in dry-run mode and review CustomRuleDryRunSignalsMatched metrics before switching selected rules to live mode.
• Exclude accounts where detected behavior is expected, such as an image-build account, rather than suppressing that behavior organization-wide.
• Scope suppression rules to the relevant finding type and workload context; verify the filtered findings before creating the rule.
• Use a no-action filter and suppression-rule metrics to assess wildcard matches before relying on a wildcard suppression rule.
• Reactivate a threat entity list after changing it; uploading a new file version alone does not apply the updates.
• Enable Runtime Monitoring when using file-hash matching or Runtime Monitoring Custom Detection Rules.
• Prefer entity lists over IP address lists when DNS query log coverage is needed.
• Review investigation confidence as well as risk, and consider cross-Region processing when assessing data-residency commitments.