GuardDuty with Delegated Administration

In this lab you’ll deploy guardDuty across our Control Tower managed organisation with the Audit account being the delegate administrator, depending on you needs you may wish to create a different account for example ‘SecOps’ in your production environment.

Create a Security Audit Group

  1. Access the AWS Single Sign On dashboard on the master account
  2. Click AWS accounts in the lefthand menu
  3. Select Audit, click on Assign users
  4. Click on the Groups tab
  5. Select AWSSecurityAuditors, click Next: Permission sets
  6. click Create new permission set
  7. scroll the page and click on SecurityAudit, then Create
  8. select SecurityAudit, and click Finish
  9. click Proceed to AWS accounts
  10. click on Users in the lefthand menu
  11. click on the test user you will use for this lab.
  12. click the Groups tab
  13. click Add to group
  14. select AWSSecurityAuditors and click Add to groups

Once you have set up GuardDuty, you can go on to investigate a security finding with the Amazon Detective service.

Identify the Audit account’s aws account number

  1. Access the Control Tower dashboard on the master account
  2. Click on Accounts in the lefthand panel
  3. find the Audit account in the list and click on it.
  4. Save the Account ID for use later.

GuardDuty Delegated Administrator

  1. Access the GuardDuty console on the master account
  2. click on Settings in the lefthand panel
  3. Scroll down to Delegated Administrator section
    1. Delegated administrator account ID : Audit Account ID
    2. click Delegate

Administer GuardDuty

  1. In a separate browser session log in as your security auditor user
  2. Access the GuardDuty console on the Audit account
  3. click on Accounts in the lefthand menu
  4. Listed will be all the accounts within the organisation, they will be marked as not a member
  5. enable Auto-enable this will ensure new accounts have GuardDuty enabled and added to the Audit account
  6. click on the checkbox at the top of the list of accounts to select all accounts.
  7. click on Actions and click
  8. Confirm add member (… accounts selected)
    1. click Add member
  9. All accounts will now be listed with :
    1. Type : Via Organisations
    2. Status : Enabled

Explore GuardDuty

  1. Access the GuardDuty dashboard on the Audit account
  2. click on Settings in the lefthand panel
  3. scroll down to Sample findings section
  4. click on Generate sample findings
  5. click on Findings in the lefthand panel
  6. You will now see a variety of sample findings listed in the table, the sample ones you generated above will be prefixed with [SAMPLE]
  7. Take some time to explore different findings types and the guidance provided about them

Investigating a Security Finding

  1. Access the GuardDuty dashboard on the Audit account
  2. click Findings in the lefthand panel
  3. Select [SAMPLE] UnauthorizedAccess:EC2/RDPBruteForce
  4. click on [SAMPLE] UnauthorizedAccess:EC2/RDPBruteForce to explore in more detail. [optional]
  5. click on Actions, and click Investigate, this will launch the Amazon Detective Dashboard

Deleting AWS resources deployed in this lab

  1. Access the GuardDuty console on the Audit account
  2. click on Accounts in the lefthand menu
  3. disable Auto-enable, confirm the action in the pop-up
  4. click on the checkbox at the top of the list of accounts to select all accounts.
  5. click on Actions and click Disassociate accounts
  6. Access the GuardDuty console on the Master account
  7. Click on Settings in the lefthand menu
  8. In the Delegated Administrator panel, click on Remove, click Remove Administrator 9, In the Suspend GuardDuty panel, click Disable GuardDuty

References

https://aws.amazon.com/blogs/aws/amazon-guardduty-continuous-security-monitoring-threat-detection/ https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_organizations.html https://aws.amazon.com/about-aws/whats-new/2019/12/introducing-amazon-detective/ https://docs.aws.amazon.com/detective/latest/adminguide/what-is-detective.html https://aws.amazon.com/blogs/security/amazon-guardduty-threat-detection-and-remediation-scenario/

Copyright 2020, Amazon Web Services, All Rights Reserved.