Custom Detection Rules in GuardDuty
Custom Detection Rules provide a library of prebuilt rules that detect activity you do not expect to occur in your AWS environment. GuardDuty builds and maintains these rules and describes each one using established threat technique vocabulary drawn from catalogs such as MITRE ATT&CK® and the AWS Threat Technique Catalog. You enable each rule for the activity you want to detect, in either dry run mode to measure it first or live mode to generate findings.
Security teams often know that certain actions should not occur in specific accounts. An action such as sharing an AMI, deleting VPC Flow Logs, or signing in without MFA can be routine in one account and a sign of compromise in another. Most GuardDuty findings identify activity that is suspicious in any environment. Custom Detection Rules let you detect activity that is suspicious only in the accounts where you do not expect it.
Custom Detection Rules use the following concepts:
- Rule
-
A prebuilt detection that GuardDuty owns and maintains. Each rule targets one threat technique and defines the conditions that cause it to match.
- Association
-
The link between a rule and an account. An association records the mode in which the rule runs for that account. A rule with no association is not evaluated.
- Mode
-
The behavior of an associated rule when it matches activity. Every rule supports two modes:
-
Live – GuardDuty generates a finding when the rule matches activity. Live mode does not expire.
-
Dry run – GuardDuty evaluates the rule and emits Amazon CloudWatch metrics but does not generate findings. Use dry run to measure signal volume before you commit to live detection. GuardDuty emits these metrics only when the rule matches an event, so a rule that never matches produces no dry run metrics. Dry run automatically expires after 14 days.
-
- Organization configuration
-
A rule configuration that the delegated GuardDuty administrator account applies to member accounts in an organization. GuardDuty creates the individual associations in each targeted account, including accounts that join later. For more information, see Managing Custom Detection Rules in multiple-account environments.
- Signal
-
One observed occurrence of the activity that a rule detects. GuardDuty aggregates signals sharing a tactic, service, and technique into a single finding.
Topics
