Generating sample findings in GuardDuty
GuardDuty RDS Protection is in preview release. Your use of the RDS Protection feature is subject to Section 2 of the
AWS Service Terms |
You can generate sample findings with Amazon GuardDuty to help you visualize and understand the various finding types that GuardDuty can generate. When you generate sample findings, GuardDuty populates your current findings list with one sample finding for each supported finding type.
The generated samples are approximations populated with placeholder values. These samples may look different from real findings for your environment, but you can use them to test various configurations for GuardDuty, such as your CloudWatch Events or filters. For a list of available values for finding types are listed in Finding types table.
To generate some common findings based on simulated activity within your environment see Automatically generating common GuardDuty findings below.
Generating sample findings through the GuardDuty console or API
Choose an access method to learn how to generate sample findings through that method.
The console method generates one of each finding type. Single sample findings can only be generated through the API.
The title of sample findings generated through these methods always begins with
[SAMPLE] in the console. Sample findings have a value of
"sample": true
in the additionalInfo section of
the finding JSON details.
Automatically generating common GuardDuty findings
You can use the following scripts
-
As a prerequisite, you must enable GuardDuty in the account and Region in which you want to run guardduty-tester.template and guardduty_tester.sh. For more information about enabling GuardDuty, see Getting started with GuardDuty.
You must also generate a new or use an existing EC2 key pair in each Region in which you want to run these scripts. This EC2 key pair is used as a parameter in the guardduty-tester.template script that you use to create a new CloudFormation stack. For more information about generating key pairs, see Amazon EC2 key pairs.
-
Create a new CloudFormation stack using guardduty-tester.template. For detailed instructions about creating a stack, see Creating a stack. Before you run guardduty-tester.template, modify it with values for the following parameters: Stack Name to identify your new stack, Availability Zone where you want to run the stack, and Key Pair that you can use to launch the EC2 instances. Then you can use the corresponding private key to access EC2 instances through SSH.
The guardduty-tester.template takes around 10 minutes to run and complete. It creates your environment and copies guardduty_tester.sh onto your tester EC2 instance.
-
In the AWS CloudFormation console, choose the checkbox next to your new running AWS CloudFormation stack. In the displayed set of tabs, select the Output tab. Note the IP addresses assigned to the bastion host and the tester EC2 instance. You need both of these IP addresses in order to access the tester EC2 instance through SSH.
-
Create the following entry in your ~/.ssh/config file to log into your instance through the bastion host.
Host bastion HostName {Elastic IP Address of Bastion} User ec2-user IdentityFile ~/.ssh/{your-ssh-key.pem} Host tester ForwardAgent yes HostName {Local IP Address of RedTeam Instance} User ec2-user IdentityFile ~/.ssh/{your-ssh-key.pem} ProxyCommand ssh bastion nc %h %p ServerAliveInterval 240
Now you can call $ ssh tester to log into your target EC2 instance. For more information about configuring and connecting to EC2 instances through bastion hosts, see https://aws.amazon.com/blogs/security/securely-connect-to-linux-instances-running-in-a-private-amazon-vpc/
. -
After you connect to the tester EC2 instance, run guardduty_tester.sh to initiate interaction between your tester and target EC2 instances, simulate attacks, and generate GuardDuty findings.