AWS Security · Domain 1
Detection
About 16% of the exam
The detection services at a glance
- GuardDuty
- continuous threat detection, agentless
- Security Hub
- aggregates findings, scores standards
- Inspector
- scans EC2, ECR, Lambda vulnerabilities
- Macie
- finds sensitive data in S3
- Detective
- behavior graphs for investigation
- AWS Config
- resource configuration history and rules
- CloudTrail
- records who called which API
- CloudWatch
- metrics, logs, alarms, dashboards
GuardDuty finds it, Security Hub collects it, Detective explains it, and Config proves what changed
CloudTrail against CloudWatch
- CloudTrail answers who called what
- CloudWatch answers what the workload did
- Management events free, data events billed
- Event history keeps ninety days
- A trail delivers to S3 indefinitely
- Log file validation proves integrity
- Organization trail covers every member account
- CloudTrail Lake gives SQL over events
What GuardDuty reads
- CloudTrail management and S3 data events
- VPC Flow Logs for network behavior
- Route 53 Resolver DNS query logs
- EKS audit logs for Kubernetes
- RDS login activity monitoring
- Runtime monitoring agent inside workloads
- Malware Protection scans EBS snapshots
- No log setup needed, reads directly
Anatomy of a GuardDuty finding
- Finding type
- threat purpose, resource, threat name
- Severity
- low, medium, high, critical
- Trusted IP list
- suppresses findings for listed addresses
- Threat IP list
- always raises a finding
- Suppression rule
- auto archives matching findings
- Archived finding
- updates quietly on recurrence
- Delegated admin
- enables detectors organization wide
- Auto enable
- covers new member accounts
Security Hub essentials
- Regional service, enable in every Region
- Aggregation Region rolls findings together
- ASFF is the common finding format
- BatchImportFindings pushes custom findings in
- Score is passed over evaluated controls
- Automation rules retag and suppress findings
- Insights group findings by filter
- Delegated administrator runs the organization
What AWS Config answers
Recorder
- Records configuration items over time
- Answers what it looked like then
- Delivery channel writes to S3
- An SCP should block stopping it
Rules
- Managed and custom rule evaluations
- Change triggered or periodic evaluation
- Conformance packs bundle rules together
- Remediation runs Systems Manager automation
Scale
- Aggregator combines accounts and Regions
- Recorder must be on per account
- Delegated administrator for organization aggregation
- Results flow into Security Hub
Amazon Macie
- Discovers sensitive data inside S3
- Managed identifiers plus custom regex
- Automated discovery samples buckets continuously
- Jobs run once or on schedule
- Policy findings flag public buckets
- Sensitive data findings name the objects
- Sampling depth trades cost against coverage
- Scope jobs tightly to cut spend
Amazon Inspector
- Continuous scanning, no scan windows
- EC2 operating system and application packages
- ECR container images scanned on push
- Lambda package and code scanning
- Score blends CVSS, EPSS, exploit availability
- Suppression rules filter by tag
- Leans on Systems Manager inventory
- Findings land in Security Hub
Amazon Detective
- Builds behavior graphs from ingested logs
- CloudTrail, Flow Logs, GuardDuty findings
- EKS audit logs are included
- Scope time bounds the investigation window
- Answers what else that identity touched
- Needs ingestion time before it helps
- Investigation tool, not a detector
- Reached from a GuardDuty finding
Log routing and retention
- CloudWatch Logs
- queryable with Logs Insights
- Subscription filter
- streams to Firehose or Lambda
- Metric filter
- turns a log pattern into metrics
- S3 Object Lock
- immutable archive for evidence
- Log destination
- cross account receiver plus policy
- CloudTrail Lake
- SQL over an event data store
- Infrequent Access class
- cheaper ingest, fewer features
- Athena
- queries logs already in S3
From signal to response
- Log or finding
- EventBridge rule
- Lambda or Step Functions
- Contain and tag
- Notify and ticket
EventBridge is the seam between detection and automation, so match on finding type and severity
Detection gaps the exam probes
- Trail stopped in a member account
- Config recorder never switched on
- Findings stranded in unaggregated Regions
- Data events off, object reads invisible
- Logs writable by the compromised account
- GuardDuty deleted rather than suspended
- Alerts with no owner or runbook
Rapid recall: pick the service
- Public bucket found
- Macie policy finding
- Odd API call from Tor
- GuardDuty finding
- What changed last Tuesday
- AWS Config history
- Who read the object
- CloudTrail data events
- Unpatched CVE on instances
- Amazon Inspector
- One console for findings
- AWS Security Hub
- Trace an attacker across logs
- Amazon Detective
- Prove logs were untouched
- CloudTrail log file validation
Reference strip: sources, producers, aggregation, evidence, tuning
Log sources
- CloudTrail management and data events
- VPC Flow Logs
- Route 53 Resolver query logs
- ELB, CloudFront and WAF logs
- EKS audit and RDS activity
Finding producers
- GuardDuty for threats
- Inspector for vulnerabilities
- Macie for sensitive data
- Config for drift
- IAM Access Analyzer for exposure
Aggregation
- Security Hub with aggregation Region
- Delegated administrator account
- ASFF normalizes every finding
- EventBridge routes to automation
Evidence
- S3 Object Lock for immutability
- Digest files chain the hashes
- Separate log archive account
- SCPs deny logging changes
Tuning
- Suppression rules cut known noise
- Trusted IP lists for scanners
- Sampling depth controls Macie cost
- Metric filters plus CloudWatch alarms
Quick exam traps
- Trap: Turning on GuardDuty also enables S3 data events in CloudTrail
- Trap: Security Hub is global, so enabling it once covers every Region
- Trap: CloudTrail can show what a security group looked like last month
- Trap: CloudTrail Event history is a permanent record of activity
- Trap: Detective detects threats, so GuardDuty becomes unnecessary
- Trap: Adding an address to a GuardDuty threat list suppresses its findings
- Trap: Inspector needs scheduled scan windows to see new vulnerabilities
- Trap: Config rules block a non-compliant resource from being created
cybercertprep.com · original revision sheet written from the public body of knowledge