快速实现AWS云中的安全威胁检测

安全团队要自行组织对VPC流日志、CloudTrail日志、DNS日志做分析，从日志收集、格式化、分析、结论、动作，整个过程是一件十分耗时费力的事情。而使用GuardDuty，只需在 AWS 管理控制台中几次点击，就可以启用 GuardDuty，实现云环境中的威胁检测。AWS在2017年推出云中威胁检测服务——GuardDuty，旨在帮助AWS用户摆脱潜在的安全威胁，保护其AWS账户和工作负载。

GuardDuty能干什么

您的账号在您从未使用过的区域启动了实例；您的EC2实例正在被攻击；您的EC2实例在你不知情的情况下开始挖掘比特币；您的EC2实例在你不知情的情况下发起网络攻击；运行渗透测试工具的机器在使用您的账户的凭证进行 API 调用。上述问题发生时，都可以被GuardDuty检测到。

GuardDuty原理

Amazon GuardDuty 是一项持续安全监控服务，通过分析数据源 (VPC 流日志、AWS CloudTrail 事件日志和 DNS 日志)、使用威胁情报源（例如，恶意 IP 地址和域的列表）和机器学习来标识您 AWS 环境中意外的和未经授权的恶意活动。

GuardDuty优势

安全团队要自行组织对VPC流日志、CloudTrail日志、DNS日志做分析，从日志收集、格式化、分析、结论、动作，整个过程是一件十分耗时费力的事情。而使用GuardDuty，只需在 AWS 管理控制台中几次点击，就可以启用 GuardDuty，无需部署或维护任何软件或硬件。

集成了来自 AWS、CrowdStrike 和 Proofpoint 的最新威胁情报源。威胁情报与机器学习和行为模型结合，帮助您检测加密货币挖矿、凭证破解行为、未经授权的异常数据访问、与已知命令和控制服务器通信或者来自已知恶意 IP 的 API 调用等活动。

安全团队可以将组织中各账户的发现结果聚合到一个 GuardDuty 管理员账户中，以便进行管理。聚合后的检测结果也可通过 CloudWatch Events 使用，从而轻松与现有的企业事件管理系统集成。

GuardDuty 可以利用 Amazon CloudWatch Events 和 AWS Lambda 执行自动化的修复操作。

GuardDuty如何收费

Amazon GuardDuty 根据分析的 AWS CloudTrail 事件数和分析的 Amazon VPC 流日志和 DNS 日志数据的容量定价。为 GuardDuty 分析启用这些日志源无需支付额外的费用。以俄勒冈区域为例，资费如下：

GuardDuty发现类型

完整的GuardDuty发现类型，参考如下网址：

https://docs.aws.amazon.com/zh_cn/guardduty/latest/ug/guardduty_finding-types-active.html

如何启用GuardDuty

如何启用GuardDuty参考如下网址：

https://docs.aws.amazon.com/zh_cn/guardduty/latest/ug/guardduty_settingup.html

如需进一步协助或服务，请留言，泰岳云业务会提供自动化工具及专业服务。

For security teams to organize their own analysis of VPC flow logs, CloudTrail logs, and DNS logs - from log collection, formatting, analysis, conclusions, to actions - the entire process is a very time-consuming and labor-intensive task. With GuardDuty, you can enable it with just a few clicks in the AWS Management Console to implement threat detection in your cloud environment. AWS launched the cloud threat detection service - GuardDuty in 2017, aiming to help AWS users avoid potential security threats and protect their AWS accounts and workloads.

What Can GuardDuty Do

Your account launched instances in regions you've never used before; your EC2 instances are being attacked; your EC2 instances are mining Bitcoin without your knowledge; your EC2 instances are launching network attacks without your knowledge; machines running penetration testing tools are making API calls using your account credentials. All of the above issues can be detected by GuardDuty when they occur.

GuardDuty Principles

Amazon GuardDuty is a continuous security monitoring service that identifies unexpected and unauthorized malicious activity in your AWS environment by analyzing data sources (VPC flow logs, AWS CloudTrail event logs, and DNS logs), using threat intelligence feeds (such as lists of malicious IP addresses and domains), and machine learning.

GuardDuty Advantages

Integrates the latest threat intelligence feeds from AWS, CrowdStrike, and Proofpoint. Threat intelligence combined with machine learning and behavioral models helps you detect activities such as cryptocurrency mining, credential cracking, unauthorized anomalous data access, communication with known command and control servers, or API calls from known malicious IPs.

Security teams can aggregate findings from accounts across the organization into a single GuardDuty administrator account for management. Aggregated detection results are also available through CloudWatch Events, making it easy to integrate with existing enterprise event management systems.

GuardDuty can use Amazon CloudWatch Events and AWS Lambda to perform automated remediation actions.

GuardDuty Pricing

Amazon GuardDuty is priced based on the number of AWS CloudTrail events analyzed and the volume of Amazon VPC flow logs and DNS log data analyzed. There are no additional charges for enabling these log sources for GuardDuty analysis. Taking the Oregon region as an example, the pricing is as follows:

GuardDuty Finding Types

For complete GuardDuty finding types, refer to the following URL: