AWS GuardDuty Connector

Amazon GuardDuty is a threat detection service that continuously monitors your AWS accounts and workloads for malicious activity and delivers detailed security findings for visibility and remediation. The connector utilises ListFindings API to fetch the findings generated on GuardDuty.

Pre-requisites

• AWS Access key
• AWS Secret key
• AWS Region
• Detector ID

How to Derive the Prerequisites

• Log in to the AWS Management Console
  • Navigate to AWS Management Console.
• Go to the IAM Dashboard – In the search bar, type IAM and select the IAM service.
  
  
  
  
  
• Go to the Policies section.
• Click Create Policy.
• Use the following JSON to define the required permissions for accessing the ListFindings and GetFindings methods:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "guardduty:ListFindings",
                "guardduty:GetFindings"
            ],
            "Resource": "*"
        }
    ]
}

• Attach Policy to a User
  • Create a new IAM user.
  • Select Programmatic Access to generate an access key and secret key.
  • Attach the policy created.
• Download the Access Key
  •  After the user is created, you’ll see the Access key ID and Secret access key. – Click Download .csv to save these credentials securely. 
  • Important : You won’t be able to view the Secret Access Key again, so ensure you download or copy it securely.

Configurations

Use the following fields to configure the AWS GuardDuty Connector in DNIF:

Field	Description
Connector Name	Provide a unique name for the connector.
AWS Access Key	AWS credentials used to authenticate API requests to AWS services.
AWS Secret Key	AWS credentials, paired with the access key to securely authorize requests.
AWS Region	The AWS region (e.g., us-east-1) where your GuardDuty instance is deployed.
Detector ID	A unique ID associated with your GuardDuty detector.

• Click Save after entering all the required details and click Test Connection, to test the configuration.
• A Connection successful message will be displayed on screen along with the time stamp.
• If the connection is not successful, an error message will be displayed. Refer Troubleshooting Connector Validations for more details on the error message.