Hands-On AWS Penetration Testing with Kali Linux

Alerting about and reacting to GuardDuty findings

By default, GuardDuty will generate findings and make them available on the web console. It is also possible to set up a CloudWatch Events rule to react to these findings as they come in. To do this through the AWS web console, we can navigate to the CloudWatch Events rule page and create a new rule. For this rule, we will select GuardDuty as the service to match, and then GuardDuty Finding as the event type to match. Then, we will select some sort of target to send the information on findings to. The target could be a variety of things, such as simple notification service (SNS) topic to then text or email the data of the finding to the security team, or possibly Lambda function, which then ...