Suppression rules
A suppression rule is a set of criteria, consisting of a filter attribute paired with a value, used to filter findings by automatically archiving new findings that match the specified criteria. Suppression rules can be used to filter low-value findings, false positive findings, or threats you do not intend to act on, to make it easier to recognize the security threats with the most impact to your environment.
After you create a suppression rule, new findings that match the criteria defined in the rule are automatically archived as long as the suppression rule is in place. You can use an existing filter to create a suppression rule or create a suppression rule from a new filter you define. You can configure suppression rules to suppress entire finding types, or define more granular filter criteria to suppress only specific instances of a particular finding type. Your suppression rules can be edited at any time.
Suppressed findings are not sent to AWS Security Hub, Amazon S3, Detective, or CloudWatch, reducing finding noise level if you consume GuardDuty findings via Security Hub, a third-party SIEM, or other alerting and ticketing applications. If you've enabled GuardDuty Malware Protection, the suppressed GuardDuty findings won't initiate a malware scan.
GuardDuty continues to generate findings even when they match your suppression rules,
however, those findings are automatically marked as archived. The
archived finding is stored in GuardDuty for 90-days and can be viewed at any time during
that period. You can view suppressed findings in the GuardDuty console by selecting
Archived from the findings table, or through the GuardDuty API
using the ListFindings API with a findingCriteria
criterion of service.archived
equal to true.
In a multi-account environment only the GuardDuty administrator can create suppression rules.
Common use cases for suppression rules and examples
The following finding types have common use cases for applying suppression rules, select the finding name to learn more about that finding, or review the info to build a suppression rule for that finding type from the console.
GuardDuty recommends that you build suppression rules reactively and only for findings you have repeatedly identified false positives for.
-
UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS – Use a suppression rule to automatically archive findings generated when VPC networking is configured to route internet traffic such that it egresses from an on-premises gateway rather than from a VPC Internet Gateway.
This finding is generated when networking is configured to route internet traffic such that it egresses from an on-premises gateway rather than from a VPC Internet Gateway (IGW). Common configurations, such as using AWS Outposts, or VPC VPN connections, can result in traffic routed this way. If this is expected behavior, it's recommended that you use suppression rules in and create a rule that consists of two filter criteria. The first criteria is finding type, which should be
UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration
. The second filter criteria is API caller IPv4 address with the IP address or CIDR range of your on-premises internet gateway. The example below represents the filter you would use to suppress this finding type based on API caller IP address.Finding type:
UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration
API caller IPv4 address:198.51.100.6
Note To include multiple API caller IPs you can add a new API Caller IPv4 address filter for each.
-
Recon:EC2/Portscan – Use a suppression rule to automatically archive findings when using a vulnerability assessment application.
The suppression rule should consist of two filter criteria. The first criteria should use the Finding type attribute with a value of
Recon:EC2/Portscan
. The second filter criteria should match the instance or instances that host these vulnerability assessment tools. You can use either the Instance image ID attribute or the Tag value attribute depending on which criteria are identifiable with the instances that host these tools. The example below represents the filter you would use to suppress this finding type based on instances with a certain AMI.Finding type:
Recon:EC2/Portscan
Instance image ID:ami-999999999
-
UnauthorizedAccess:EC2/SSHBruteForce – Use a suppression rule to automatically archive findings when it is targeted to bastion instances.
If the target of the brute force attempt is a bastion host, this may represent expected behavior for your AWS environment. If this is the case, we recommend that you set up a suppression rule for this finding. The suppression rule should consist of two filter criteria. The first criteria should use the Finding type attribute with a value of
UnauthorizedAccess:EC2/SSHBruteForce
. The second filter criteria should match the instance or instances that serve as a bastion host. You can use either the Instance image ID attribute or the Tag value attribute depending on which criteria is identifiable with the instances that host these tools. The example below represents the filter you would use to suppress this finding type based on instances with a certain instance tag value.Finding type:
UnauthorizedAccess:EC2/SSHBruteForce
Instance tag value:devops
-
Recon:EC2/PortProbeUnprotectedPort – Use a suppression rule to automatically archive findings when it is targeted to intentionally exposed instances.
There may be cases in which instances are intentionally exposed, for example if they are hosting web servers. If this is the case in your AWS environment, we recommend that you set up a suppression rule for this finding. The suppression rule should consist of two filter criteria. The first criteria should use the Finding type attribute with a value of
Recon:EC2/PortProbeUnprotectedPort
. The second filter criteria should match the instance or instances that serve as a bastion host. You can use either the Instance image ID attribute or the Tag value attribute, depending on which criteria is identifiable with the instances that host these tools. The example below represents the filter you would use to suppress this finding type based on instances with a certain instance tag key in the console.Finding type:
Recon:EC2/PortProbeUnprotectedPort
Instance tag key:prod
To create suppression rules in GuardDuty
Choose your access method to create or manage suppression rules in GuardDuty.