Amazon GuardDuty is a threat detection service that continuously monitors Amazon Web Services accounts and workloads for malicious activity and delivers detailed security findings for visibility and remediation.
Smart SOAR Integration
Smart SOAR’s integration with AWS GuardDuty enables automation-powered response to cloud security alerts. GuardDuty produces security findings based on its analysis of logs, threat intelligence, and machine learning, which enables it to detect unusual or suspicious activity in your AWS environment. Smart SOAR can retrieve security findings from GuardDuty in order to rapidly orchestrate a response.
Automate response to GuardDuty alerts
Orchestrate across hundreds of integrated systems, including AWS platforms such as EC2, Lambda, SSM, and S3 Buckets
Capture suspicious behaviors that slip past signature-based tools
Seamlessly oversee hybrid environments, by managing cloud and on-premise incident response through Smart SOAR
Key Use Cases
AWS GuardDuty can detect compromised EC2 instances that have been hijacked by an adversary to mine bitcoin. Smart SOAR retrieves that event and extracts IOCs and TTPs to compare against third-party threat intelligence to determine risk. Based on this information, the user can escalate the event to an incident if further investigation is required. Smart SOAR has a prebuilt automation-powered playbook for cryptomining, which includes domain analysis and EC2 instance analysis.
Insider Threat Detection and Mitigation
AWS GuardDuty can be utilized to identify potential insider threats by monitoring and flagging unusual data access patterns or unauthorized attempts to access sensitive data. Smart SOAR, upon receiving such alerts, employs its MITRE ATT&CK framework correlation to categorize the nature of the threat, focusing on tactics and techniques indicative of insider behavior. Smart SOAR's automation capabilities then kick in, extracting IOCs and comparing them against known threat intelligence. If the threat is verified, D3 activates a specialized playbook for insider threats, which includes steps for securing compromised accounts, assessing data exposure, and initiating necessary legal or HR protocols.
Meet Our Friends
Our Connected SOAR Security Alliance brings hundreds of vendors together, allowing customers to benefit from our deep industry relationships and fully vendor-agnostic, independent SOAR platform.