Managing Custom Detection Rules
GuardDuty applies a rule to an account through an association. An association links a rule to your account and records the mode, live or dry run, in which the rule operates.
In an organization, the delegated GuardDuty administrator account uses organization configurations to manage rules for member accounts centrally. An organization configuration supports include and exclude lists to control which accounts a rule applies to. For more information, see Managing Custom Detection Rules in multiple-account environments.
Listing available rules
The rule catalog lists every available rule, with filters for name, severity, data source, MITRE ATT&CK® tactic, technique, and AWS service.
Viewing rule status
Each rule in your account has one of three statuses:
-
Live – The rule is associated in live mode and generates findings.
-
Dry run – The rule is associated in dry run mode and emits Amazon CloudWatch metrics only.
-
Disabled – The rule has no association and is not evaluated.
Bulk operations
Bulk operations apply the same mode change to more than one rule, or to one rule across more than one account.
Dry run
In dry run mode, GuardDuty evaluates events against the rule but does not generate findings. Instead, GuardDuty emits Amazon CloudWatch metrics that you can use to evaluate signal volume and rule behavior before enabling live detection. GuardDuty publishes these metrics only when the rule matches an event; if a rule never matches, it produces no dry run metrics.
Use dry run mode to understand how a rule behaves in your environment without triggering automated responses or generating findings in the console.
Note
A dry run association expires 14 days after it is created. When it expires, GuardDuty stops evaluating the rule for that account and the rule returns to disabled. To evaluate the rule again, create a new dry run association. Live associations do not expire.
Live
In live mode, GuardDuty generates findings that appear in the GuardDuty console. Findings are exported to Amazon EventBridge and, if you configure one, to an Amazon S3 bucket that you own. Findings are also sent to integrated AWS services such as AWS Security Hub. Use live mode for active threat detection in your environment.
Disabling rules
Disabling a rule removes the association and stops GuardDuty from evaluating events against that rule for your account.
