Amazon GuardDuty

Send alerts from GaurdDuty to Squadcast

Amazon GuardDuty is a continuous security monitoring service that analyzes and processes data sources, such as AWS CloudTrail data events for Amazon S3 logs, CloudTrail management event logs, DNS logs, Amazon EBS volume data, Amazon EKS audit logs, and Amazon VPC flow logs.

How to integrate Amazon GuardDuty with Squadcast

  1. Navigate to Services -> Service Overview -> select or search for your Service. Expand the accordion -> In the Alert Sources section, click Add.

Integration of Amazon GuardDuty with Squadcast

2. Select Amazon GuardDuty. Copy the displayed Webhook URL to configure it within Amazon GuardDuty. Finish by clicking Add Alert Source -> Done.

Webhook URL configuration within Amazon GuardDuty

In AWS: Configure SNS Endpoint

  1. Log in to your AWS account and proceed to SNS

  2. Click on Create topic

  3. Within the dialog box, fill in the details as per your requirements and then click on Create topic

Configure SNS Endpoint In AWS - Create Topic
  1. Inside the topic, click on Create Subscription

Create subscription inside the topic to Configure SNS Endpoint in AWS
  1. Select the protocol as HTTPS and in the endpoint enter the URL you obtained from the previous step.

  2. Finally, click on Create Subscription to create the subscription

Select the protocol as HTTPS and in the endpoint to configuration

In AWS: Configure GuardDuty

  1. If you have not enabled GuardDuty, please follow Amazon’s documentation.

Or, if you have already enabled GuardDuty, skip to step 2

  1. Once you have enabled GuardDuty, you can begin building EventBridge Rules to send alerts to Squadcast. Search and select EventBridge from the Services search bar

  2. Select Rules from the left menu, then click Create Rule. One or more rules can be created to send specific events to Squadcast when a GuardDuty finding is opened

Configure GuardDuty in AWS - Create rules
  1. On the next page, perform the following:

  • Name: Enter a name that can be easily identified

  • Description (optional): Enter a description of the rule, pattern, and target(s)

  • Event Bus: Select Default

  • Enable the rule on the selected event bus: Toggle to the on position

  • Rule with an event pattern: This will automatically be preselected

  • Click Next to continue

select AWS event source as AWS events or EventBridge partner events
Selection of AWS event in sample event
  1. On the next page, perform the following:

  • Event source: Select AWS events or EventBridge partner events

  • Sample event (optional): If you would like to view sample events, you may do so in this section

  • Event Source: Select AWS services

  • AWS Service: Select GuardDuty

  • Event type: Select GuardDuty Finding

  • Click Next to continue

Event Pattern: Event source: AWS service, AWS service: GuardDuty Event type: GuardDuty finding
  1. On the next page, perform the following:

  • Target types: Select AWS service

  • Select a target: Search and select SNS topic

  • Topic: Search and select the topic created in previous steps

  • Configure other additional settings to your preference

  • Click Next to continue

Selection of Target type: AWS service, target: SNS topic, Topic: Squadcast delivery to complete guardDuty integration
  1. On the next page, optionally add tags to your preference. Click Next to continue

  2. On the final page, review your settings and click Create Rule. If you would like to create more rules, repeat steps 3-7

That's it, you are good to go!

  • Your Amazon GuardDuty integration is complete. Now, whenever an event is triggered that matches your Event Rules, an incident will be created in Squadcast for it.

Last updated

Was this helpful?

#426: Past Incidents

Change request updated