Smart SOAR Integration

Smart SOAR’s integration with AWS GuardDuty enables automation-powered response to cloud security alerts. GuardDuty produces security findings based on its analysis of logs, threat intelligence, and machine learning, which enables it to detect unusual or suspicious activity in your AWS environment. Smart SOAR can retrieve security findings from GuardDuty in order to rapidly orchestrate a response.

AWS GuardDuty Integration

Integration Features

Automate response to GuardDuty alerts
Orchestrate across hundreds of integrated systems, including AWS platforms such as EC2, Lambda, SSM, and S3 Buckets
Capture suspicious behaviors that slip past signature-based tools
Seamlessly oversee hybrid environments, by managing cloud and on-premise incident response through Smart SOAR

Key Use Cases

#1

Cryptomining

AWS GuardDuty can detect compromised EC2 instances that have been hijacked by an adversary to mine bitcoin. Smart SOAR retrieves that event and extracts IOCs and TTPs to compare against third-party threat intelligence to determine risk. Based on this information, the user can escalate the event to an incident if further investigation is required. Smart SOAR has a prebuilt automation-powered playbook for cryptomining, which includes domain analysis and EC2 instance analysis.
#2

Insider Threat Detection and Mitigation

AWS GuardDuty can be utilized to identify potential insider threats by monitoring and flagging unusual data access patterns or unauthorized attempts to access sensitive data. Smart SOAR, upon receiving such alerts, employs its MITRE ATT&CK framework correlation to categorize the nature of the threat, focusing on tactics and techniques indicative of insider behavior. Smart SOAR's automation capabilities then kick in, extracting IOCs and comparing them against known threat intelligence. If the threat is verified, D3 activates a specialized playbook for insider threats, which includes steps for securing compromised accounts, assessing data exposure, and initiating necessary legal or HR protocols.

Meet Our Friends

Our Connected SOAR Security Alliance brings hundreds of vendors together, allowing customers to benefit from our deep industry relationships and fully vendor-agnostic, independent SOAR platform.

View All Integrations
X AWS GuardDuty Integration

Get Started with D3 Security

One platform to stop alert overwhelm. Transform how your security team works, by focusing its resources on real threats.
Get Started