Skip to main content

Using Stax-managed GuardDuty

Amazon GuardDuty is a threat detection service that monitors for malicious or unauthorized behavior within your AWS accounts. It also detects compromised AWS resources.

As part of Stax’s well-architected foundation, Stax allows you to implement and manage Amazon GuardDuty. As a baseline, Stax configures the below for you:

  • Enabled for all accounts and regions in the AWS Organization

  • Security account designated as the delegated administrator

  • All findings in the AWS Organization centralized in the Security Account in your Stax Installation Region

  • All findings exported to an S3 bucket in the Logging Account*

In addition to this, Amazon GuardDuty also offers protection plans, which analyse non-foundational data sourcesfor potential security threats. Stax allows you to configure these plans, as well as set the findings export frequency for all GuardDuty findings. For a list of plans that can be configured within Stax, see below:

If you choose to enable these plans, ensure you are aware of the pricing dimensionsfor Amazon GuardDuty.

*If you have an existing S3 bucket configured as your publishing destination, this S3 bucket will be utilised instead.

Before You Begin​

  • Estimated time to complete: 10 minutes (Deployment can take a few minutes or up to 2 hours depending on the number of in-scope accounts)

  • Ensure you are a member of the Adminrolein your Stax tenancy

  • Ensure you are authorized to override any existing configurations of GuardDuty

Configure GuardDuty​

  1. Log in to the Stax Console

  2. Click Organization in the left-hand nav

  3. Choose Foundation Services in the sub-menu, beneath Service Control Policies, then Get Started on the Stax-managed GuardDuty tile

  4. Review the changes that will be made as a result of configuring the service, then choose Continue

  5. Select the checkbox to confirm you will be overriding any existing Guard Duty configuration.

  6. Optional: Choose the protection plans you wish to enable, and the findings export frequency

  7. Choose Configure

AWS GuardDuty will take some time to configure depending on the number of AWS accounts you have. Once configured, Stax-managed GuardDuty will transition from Configuring to Active on the Foundation Services page.

Update Amazon GuardDuty Configuration​

Once you have configured Stax-managed GuardDuty, you can enable and disable the protection plans offered in Amazon GuardDuty and alter the findings export frequency.

  1. On the Foundation Services page, choose the settings cog on the Stax-managed GuardDuty tile

  2. Click on the Edit icon next to Settings

  3. Enable or disable a protection plan by clicking the toggle. Alternatively, adjust the findings export frequency by clicking the respective radio button

  4. Click Save

AWS GuardDuty will take some time to configure depending on the number of AWS accounts you have. Once configured, Stax-managed GuardDuty will transition from Configuring to Active on the Foundation Services page.

View Amazon GuardDuty Findings​

To view findings from Amazon GuardDuty, you will need to log into the Security account in the aggregation region that Stax has configured for you.

Before you can log in to the account, you must be a member of a group that grants you appropriate access to the Security foundation account.

  1. Choose Accounts in the left-hand nav

  2. Click the log in button next to your organization's Security foundation account

  3. Choose the role you wish to assume. The AWS Management Console will open in a new tab

  4. Switch to your organization's aggregation region. The aggregation region is the AWS region of your Stax Installation Region

  5. Navigate to the Amazon GuardDuty service to review the findings for your organization's accounts