Skip to main content
Sumo Logic

Lab 10 - Visibility into the security of your AWS environment

AWS GuardDuty is useful to detect twelve potential threats shown below. It monitors the security of your AWS environment by analyzing and processing VPC Flow Logs, AWS CloudTrail event logs, and DNS logs. This app for Amazon GuardDuty provides insights into the activities in your AWS account based on the findings from Amazon GuardDuty. The App includes preconfigured dashboards that allow you to detect unexpected and potentially malicious activities in your AWS account by providing details on threats by severity, VPC, IP, account ID, region, and resource type.

Screen Shot 2020-04-17 at 4.12.59 PM.png

In this lab you will install the Amazon GuardDuty app. You will monitor the dashboards and investigate your highest count threats. Use our clickable links right from the dashboards, and instantly be routed to your AWS EC2 environment for rapid remediation efforts.

 

Lab Activity

Install the AWS GuardDuty app 

  1. The best way to see your ingested AWS environment is to install our Sumo Logic AWS GuardDuty app.  Sumo Logic apps deliver out-of-the-box dashboards, saved searches, and field extraction for popular data sources. With an app, you can start exploring your data source within minutes. To view the AWS GuardDuty data from your source, let's install the AWS GuardDuty app. Click App Catalog in the left navigation panel.

  1. Enter GuardDuty in the search field, and press Return to show the matching appsScreen Shot 2020-04-17 at 4.28.02 PM.png
  2. Double-click Amazon GuardDuty to open its app page, and click Add to Library.

Screen Shot 2020-04-17 at 4.29.55 PM.png

  1. The dialog box that opens includes options to choose the folder where you install the app and to select a category for your data source.
  2. Let's keep the folder as the default (Personal). You have the ability to alter the name of App, but let's name it Amazon GuardDuty<your intials ##> ending with your intials and any 2 numbersThis App name will be necessary to reference in the Using Sumo Logic Tutorial later, so by adding your intials you will be able to find the app you installed.
  3. For the log data source, select Source Categories, and select the source category Labs/AWS/GuardDuty_V8. This is how you map your Amazon GuardDuty data to the out-of-the-box Amazon GuardDuty app.
  4. Click Add to Library to confirm your selections and add the app to the library.

Screen Shot 2020-04-17 at 4.34.31 PM.png

Investigate your findings 

  1. Now that the app is created, let’s see what is happening. Click Personal on the left navigation panel or on the Library page, and double-click the Amazon GuardDuty<your intials>## folder.
  2. Notice that the app includes predefined dashboards. 

Screen Shot 2020-04-17 at 5.06.48 PM.png

  1. Let’s open two dashboards. In the left navigation pane, scroll down to the Amazon GuardDuty - Overview dashboard and double-click. The dashboard opens to show panels that are already created for you. Then scroll down to the Amazon GuardDuty - Details dashboard and double-click. First let's look at the Amazaon GuardDuty - Overview dashboard, click on it's tab. This dashboard allows you to gain rapid insights into the severity and frequency of GuardDuty findings for effective remediation efforts. Scroll to the Threats by ThreatPurpose, ResourceType, ThreatName panel. We can see Recon as our largest count in the last 24 hours. Click Show in Search icon to open the underlying query.

    Screen Shot 2020-09-03 at 6.03.20 PM.png
  2. You want to investigate your highest recon account activity. To detect this, add accountid to the count line as below and rerun the query.

    | count as count by ThreatPurpose,ResourceType,ThreatName,accountid

     
  3. The results may look like this.

    Screen Shot 2020-09-03 at 6.10.19 PM.png

 

  1. Left of the highest count on the top line, copy the accountid. Highlight the account id and right mouse click.

    Screen Shot 2020-09-03 at 6.13.42 PM.png

     
  2. GuardDuty findings and raw log data can easily be filtered by metadata tags for more granular search and detailed analysis. Search metadata tags include User ID, Region, VPC, subnet, instance ID, ports, IPs, Principle ID, Access Key ID, etc. Now we will filter by and account the number copied above. At the top right corner of any panel, click on the blue filter icon, Screen Shot 2020-04-17 at 5.45.03 PM.png. Paste the copied account number.

Screen Shot 2020-04-17 at 5.46.22 PM.png

  1. You will see all the dashboard panel pivot to display the information for that accountid. This is a useful technique of using the dashboard filters already provided for quick analysis on a particular aspect. Try hovering over the data in the Severity and AccountID panel below to observe the effect.

    Screen Shot 2020-09-03 at 6.20.53 PM.png
     
  2. Now click on the open tab for the other dashboard, Amazon GuardDuty - Details.  In closer examination, this dashboard gives us the various ways to monitor the threats. In the Threat Details Summary Table you can examine your highest count threats. Simply click on the blue finding link and instantly be routed to your AWS EC2 environment for rapid remediation efforts.

In this training environment we don't have an AWS linked so it will take you to an AWS login page.

Screen Shot 2020-04-17 at 5.55.17 PM.png

Quiz (True or False?)

  1. The AWS GuardDuty app monitors threat findings that may be instantly routed to my AWS instances. 

  2. The dashboard and panel filter turns green if enabled.

  3. I can modify a panel query to extract additional information.

Summary

Congratulations! You’ve completed these tasks:

  1. Installed AWS GuardDuty app.

  2. Filtered on accountID at the dashboard level.

  3. Modified a panels query to obtain information.

  4. Learned where to link to AWS for further investigation of any threat findings.