GuardDuty - Protection plans

Prequisite

Make sure the EC2 instance has the SSM Management Role (instance profile). For how to add instance profile to an EC2 instance, please refer more in https://docs.aws.amazon.com/systems-manager/latest/userguide/setup-instance-permissions.html#attach-instance-profile.

Amazon S3 protection in Amazon GuardDuty

1. Visit the S3 Protection page under Protection plans in the GuardDuty console.

2. Make sure that S3 Protection is enabled.

EKS Protection in Amazon GuardDuty

3. Visit the EKS Protection page under Protection plans in the GuardDuty console.

4. Make sure that EKS Audit Log Monitoring is enabled. Note: Console experience for GuardDuty EKS Runtime Monitoring is now managed as part of the new Runtime Monitoring feature.

Runtime Monitoring in Amazon GuardDuty

5. Visit the Runtime Monitoring page under Protection plans in the GuardDuty console.

6. Make sure that Runtime Monitoring is enabled along with Automated agent configuration for each Amazon EKS, AWS Fargate (ECS only), and Amazon EC2.

7. On the Runtime Monitoring page, switch to the tab Runtime coverage. What are the “Coverage statistics”? While out of scope for this workshop, learn more about setting up Runtime Monitoring at https://docs.aws.amazon.com/guardduty/latest/ug/runtime-monitoring.html .

Note: If the EC2 Instance Coverage status is unhealthy and the Issue status is “No Agent Reporting” or something related to SSM it may be due to SSM agent can not be installed in the EC2 instance. You can clarify by check /var/log/amzn-guardduty-agent in the instance (AL2, AL2023). Further read https://docs.aws.amazon.com/guardduty/latest/ug/gdu-assess-coverage-ec2.html#ec2-runtime-monitoring-coverage-issues-troubleshoot

Malware Protection for EC2 in Amazon GuardDuty

8. Visit the Malware Protection page under Protection plans in the GuardDuty console.

9. GuardDuty automatically initiates a malware scan after generating a finding indicative of malware in an EC2 instance or a container workload. Make sure that GuardDuty-initiated malware scan is enabled. Here are some EC2 malware scans If you follow a scan through Scan ID EICAR-Test file is a file to check whether the threat detection function works. It is not a real virus.

10. Scroll down and toggle Retain scanned snapshots when malware is detected on.

RDS Protection in Amazon GuardDuty

11. Visit the RDS Protection page under Protection plans in the GuardDuty console.

12. Make sure that RDS Login Activity Monitoring is enabled.

Lambda Protection in Amazon GuardDuty

13. Visit the Lambda Protection page under Protection plans in the GuardDuty console.

14. Make sure that Lambda Network Activity Monitoring is enabled.