Collect AWS GuardDuty logs

Parser Version:22.0

This document describes how you can collect AWS GuardDuty logs by setting up a Google Security Operations feed.

For more information, see Data ingestion to Google Security Operations .

An ingestion label identifies the parser which normalizes raw log data to structured UDM format. The information in this document applies to the parser with the GUARDDUTY ingestion label.

Before you begin

Ensure that you have the following prerequisites:

• AWS S3 bucket is created. To create the AWS S3 bucket, see Create your first S3 bucket .
• KMS key is created. To create the KMS key, see Creating asymmetric KMS keys .
• AWS GuardDuty has permission to access the KMS key. To grant access to the KMS key, see Exporting findings . GuardDuty encrypts the findings data in your bucket by using an AWS KMS key.

Configure AWS GuardDuty

To configure AWS GuardDuty, do the following:

1. Sign in to the AWS console.
2. Search for GuardDuty.
3. Select Settings.

4. In the Finding export optionsection, do the following:

   1. From the Frequency for updated findingslist, select Update CWE and S3 every 15 minutes. The frequency selection is for the updated findings. The new findings are exported after 5 minutes from the time of creation.
   2. In the S3 bucketsection, select the S3 bucket in which you want to export the GuardDuty findings.
   3. In the Log file prefixsection, provide the log file prefix.
   4. In the KMS encryptionsection, select the KMS encryption.
   5. From the Key aliaslist, select the key.
   6. Click Save.

5. After the log files are stored in the S3 bucket, create an SQS queue and attach it with the S3 bucket.

Sample KMS policy

The following is a sample KMS policy:

 {
            "Sid": "Allow GuardDuty to encrypt findings",
            "Effect": "Allow",
            "Principal": {
                "Service": "guardduty. AWS_REGION 
.amazonaws.com"
            },
            "Action": [
                "kms:Encrypt",
                "kms:GenerateDataKey"
            ],
            "Resource": " KEY_ARN 
"
        } 

Replace the following:

• AWS_REGION : the chosen region.
• KEY_ARN : Amazon Resource Name (ARN) of the KMS key.

Check the required IAM user and KMS key policies for S3, SQS, and KMS.

Based on the service and region, identify the endpoints for connectivity by referring to the following AWS documentation:

• For information about any logging sources, see AWS Identity and Access Management endpoints and quotas .
• For information about S3 logging sources, see Amazon Simple Storage Service endpoints and quotas .
• For information about SQS logging sources, see Amazon Simple Queue Service endpoints and quotas .

Set up feeds

To configure a feed, follow these steps:

1. Go to SIEM Settings > Feeds.
2. Click Add New Feed.
3. On the next page, click Configure a single feed.
4. Enter a unique name for the Feed name.
5. Select Amazon S3 V2or Amazon SQS V2as the Source type.
6. Select AWS GuardDutyas the Log type.
7. Click Nextand then click Submit.
8. Google Security Operations supports log collection using an access key ID and secret method. To create the access key ID and secret, see Configure tool authentication with AWS .

9. Based on the AWS GuardDuty configuration that you created, specify values for the following fields.

   1. If using Amazon S3 V2
   • **S3 URI**
   • **Source deletion option**
   • **Maximum File Age**
   2. If using Amazon SQS V2
   • Queue name
   • Account number
   • Queue access key ID
   • Queue secret access key
   • Source deletion option
   • Maximum File Age

10. Click Nextand then click Submit.

For more information about Google Security Operations feeds, see Google Security Operations feeds documentation . For information about requirements for each feed type, see Feed configuration by type . If you encounter issues when you create feeds, contact Google Security Operations support

Field mapping reference

This parser code processes AWS GuardDuty findings in JSON format, extracting relevant fields and mapping them to a unified data model (UDM). It performs data transformations, including string replacements, merging arrays, and converting data types, to create a structured representation of the security event for analysis and correlation.

UDM mapping table

Change Log

View the Change Log for this parser

Need more help? Get answers from Community members and Google SecOps professionals.