"AWS Guard Duty Forensics & Incident Response" provides an overview of the AWS Guard Duty service and its forensic capabilities. AWS Guard Duty is a managed threat detection service that continuously monitors the AWS environment for potential malicious activity. The talk focuses on how Guard Duty can be used for incident response by providing detailed forensic data that can be used to investigate security incidents.

1. AWS Guard Duty
Forensics & Incident
Response
Cado Security | 1

2. What is GuardDuty?
https://aws.amazon.com/guardduty/

3. What is GuardDuty?
https://aws.amazon.com/guardduty/

4. What are common GuardDuty Detections?
https://docs.aws.amazon.com/guardduty/latest/ug/logging-using-cloudtrail.html
AWS CloudTrail Management events that GuardDuty monitors:
- Configuring security (IAM AttachRolePolicyAPI operations); - Configuring rules for routing data (Amazon EC2 CreateSubnet API operations); -
Setting up logging (AWS CloudTrail CreateTrail API operations)
AWS CloudTrail data events that GuardDuty monitors:
Data events, also known as data plane operations, provide insight into the resource operations performed on or within a resource. They are often
high-volume activities. E.g.
- GetObject API operations; - PutObject API operations; - ListObjects API operations; - DeleteObject API operations
Kubernetes audit logs
Amazon EKS allows Kubernetes audit logs to be ingested as Amazon CloudWatch Logs through the EKS control plane logging feature.
VPC Flow Logs
The VPC Flow Logs feature of Amazon VPC captures information about the IP traffic going to and from network interfaces within your environment.
When you enable GuardDuty, it immediately starts analyzing your VPC flow logs data.
DNS logs
If you use AWS DNS resolvers for your Amazon EC2 instances (the default setting), then GuardDuty can access and process your request and
response DNS logs through the internal AWS DNS resolvers.
Elastic Block Storage (EBS) volume
GuardDuty Malware Protection scans and detects malware on Amazon EBS volumes attached to your Amazon EC2 instances.
RDS login activity monitoring
RDS login activity captures both successful and failed login attempts made to the Supported Amazon Aurora databases in your AWS environment.

5. What are common GuardDuty Findings?
https://aws.amazon.com/blogs/aws/new-using-amazon-guardduty-to-protect-your-s3-buckets/

6. What Threat Intelligence is in Guard Duty?
https://maturitymodel.security.aws.dev/en/4.-optimized/threat-intellingence/

7. How does GuardDuty appear in Cado?

8. How can you automate the Response to
GuardDuty Alerts?
https://github.com/cado-security/guardduty-lambda-cado

9. Cado Response
Free 14-day trial
Receive unlimited access to
the Cado Response Platform
for 14 days.
www.cadosecurity.com/free-investigation/