Ctrlk
BlogSupport
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Integrate Prisma Cloud with Amazon GuardDuty

Learn how to integrate Prisma® Cloud with Amazon GuardDuty.

Amazon GuardDuty is a continuous security monitoring service that analyzes and processes Virtual Private Cloud (VPC) Flow Logs and AWS CloudTrail event logs. GuardDuty uses security logic and AWS usage statistics techniques to identify unexpected and potentially unauthorized and malicious activity.

Prisma® Cloud integrates with GuardDuty and extends its threat visualization capabilities. Prisma Cloud starts ingesting GuardDuty data, correlates it with the other information that Prisma Cloud already collects, and presents contextualized and actionable information through the Prisma Cloud app.

  1. Enable Amazon GuardDuty on your AWS instances (see Amazon Documentation).

  2. Enable read-access permissions to Amazon GuardDuty on the IAM Role policy.

    The Prisma Cloud IAM Role policy you use to onboard your AWS setup needs to include these permissions:

    • guardduty:List

    • guardduty:Get

      tt:[NOTE] If you used the CFT templates to onboard your AWS account, the Prisma Cloud IAM Role policy already has the permissions required for Amazon GuardDuty.

  3. After Prisma Cloud has access to the Amazon GuardDuty findings, use RQL queries for visibility into the information collected from Amazon GuardDuty.

    1. Navigate to Investigate > Search page.

    2. To search for Config Query, enter the following RQL query.

      config from cloud.resource where cloud.type = 'aws' AND finding.type = 'AWS GuardDuty Host'

      The query returns a list of affected assets for further investigation. Select an asset to view the Finding Types side panel. The panel lists threats or security issues associated with the asset.

      tt:[NOTE] Prisma Cloud supports only EC2 and IAM finding types for GuardDuty.

      guardduty audit trail

      Click Findings for information related to vulnerabilities. Select AWS GuardDuty Host or AWS GuardDuty IAM in the filter to view vulnerabilities detected by AWS GuardDuty.

      guardduty host findings
      config from cloud.resource where api.name = 'aws-iam-list-access-keys' AND finding.source = 'AWS Guard Duty'

    3. To search for Network Query, enter the following RQL query.

      network from vpc.flow_record where dest.resource IN ( resource where finding.type = 'AWS GuardDuty Host' )

      The query returns a visual representation of the assets for further investigation.

      guardduty network query
PreviousPrisma Cloud IntegrationsNextIntegrate Prisma Cloud with AWS Inspector

Last updated

Was this helpful?