Managing Amazon GuardDuty findings
GuardDuty offers several important features to help you sort, store, and manage your findings. These features will help you tailor findings to your specific environment, reduce noise from low value findings, and help you focus on threats to your unique Amazon environment. Review the topics on this page to understand how you can use these features to increase the value of GuardDuty's findings.
Topics:
- Summary dashboard
-
Learn about the components of the summary dashboard available in the GuardDuty console.
- Filtering findings
-
Learn how to filter GuardDuty findings based on criteria you specify.
- Suppression rules
-
Learn how to automatically filter the findings GuardDuty alerts you to through suppression rules. Suppression rules automatically archive findings based on filters.
- Working with trusted IP lists and threat lists
-
Customize the GuardDuty monitoring scope using IP Lists and Threat Lists based on publicly-routable IP addresses. Trusted IP lists prevent non-DNS findings from being generated from IP's you consider trusted, while Threat Intel Lists will cause GuardDuty to alert you of activity from user-defined IPs.
- Exporting findings
-
Export the generated findings to an Amazon S3 bucket so that you can maintain records past the 90-day findings retention period in GuardDuty. Use this historical data to track potential suspicious activities in your account and evaluate whether the recommended remediation steps were successful.
- Creating custom responses to GuardDuty findings with Amazon CloudWatch Events
-
Set up automatic notifications for GuardDuty findings through Amazon CloudWatch events. You can also automate other tasks through CloudWatch Events to help you respond to findings.
- Understanding CloudWatch Logs and reasons for skipping resources during Malware Protection scan
-
Learn how you can audit the CloudWatch Logs for GuardDuty Malware Protection and what are the reasons because of which your impacted Amazon EC2 instance or Amazon EBS volumes may have been skipped during the scanning process.
- Reporting false positives in GuardDuty Malware Protection
-
Learn about the false positive experience in GuardDuty Malware Protection and how you can report false positive threat detections.