기계 번역으로 제공되는 번역입니다. 제공된 번역과 원본 영어의 내용이 상충하는 경우에는 영어 버전이 우선합니다.
과 AWS Security Hub통합
AWS Security Hub에서는 AWS 에서 보안 상태를 포괄적으로 파악할 수 있으며 보안 업계 표준 및 모범 사례와 비교하여 환경을 확인할 수 있습니다. Security Hub는 AWS 계정, 서비스 및 지원되는 타사 파트너 제품 전반에서 보안 데이터를 수집하여 보안 동향을 분석하고 가장 우선순위가 높은 보안 문제를 식별하는 데 도움을 줍니다.
Amazon과 Security Hub의 GuardDuty 통합을 통해 보안 허브에서 GuardDuty 조사 결과를 전송할 수 있습니다. 그러면 Security Hub의 보안 태세 분석에 이러한 결과가 포함됩니다.
목차
Amazon에서 조사 결과를 GuardDuty 다음 주소로 보내는 방법 AWS Security Hub
AWS Security Hub에서는 보안 문제가 발견으로 추적됩니다. 일부 결과는 다른 AWS 서비스나 타사 파트너가 감지한 문제에서 비롯됩니다. Security Hub에는 보안 문제를 감지하고 조사 결과를 생성하는 데 사용하는 규칙 집합도 있습니다.
Security Hub는 이러한 모든 출처를 총망라하여 조사 결과를 관리할 도구를 제공합니다. 사용자는 조사 결과 목록을 조회하고 필터링할 수 있으며 주어진 조사 결과의 세부 정보를 조회할 수도 있습니다. 자세한 내용은 AWS Security Hub User Guide의 Viewing findings를 참조하세요. 또한 주어진 결과에 대한 조사 상태를 추적할 수도 있습니다. 자세한 내용은 AWS Security Hub User Guide의 Taking action on findings를 참조하세요.
Security Hub의 모든 검색 결과는 AWS 보안 검색 결과 JSON 형식 (ASFF) 이라는 표준 형식을 사용합니다. ASFF여기에는 문제의 원인, 영향을 받는 리소스, 검색 결과의 현재 상태에 대한 세부 정보가 포함됩니다. AWS Security Hub 사용 설명서의 AWS 보안 검색 결과 형식 (ASFF) 을 참조하십시오.
GuardDuty Amazon은 조사 결과를 Security Hub로 보내는 AWS 서비스 중 하나입니다.
Security Hub로 GuardDuty 보내는 검색 결과 유형
동일한 계정 내에서 Security Hub를 GuardDuty 활성화하고 나면 생성된 모든 검색 결과를 Security Hub로 보내기 GuardDuty 시작합니다. AWS 리전이러한 검색 결과는 보안 검색 결과 형식 (ASFF) 을 사용하여AWS
Security Hub에 전송됩니다. 에서 ASFF Types 필드는 검색 유형을 제공합니다.
새 검색 결과 전송 지연 시간
새 검색 결과가 GuardDuty 생성되면 일반적으로 5분 이내에 Security Hub로 전송됩니다.
Security Hub를 사용할 수 없을 때 다시 시도
Security Hub를 사용할 수 없는 경우 결과를 받을 때까지 전송을 GuardDuty 재시도합니다.
Security Hub에서 기존 조사 결과 업데이트
검색 결과를 Security Hub로 보낸 후 검색 결과 활동에 대한 추가 관찰 내용을 반영하는 업데이트를 Security Hub에 GuardDuty 보냅니다. 이러한 결과에 대한 새로운 관찰 결과는 사용자의 5단계 — 검색 결과 내보내기 빈도 설정에 따라 Security Hub로 전송됩니다 AWS 계정.
검색 결과를 보관하거나 보관 취소하는 경우 Security Hub에 해당 검색 결과를 보내지 GuardDuty 않습니다. 수동으로 보관하지 않은 검색 결과가 나중에 활성화되면 Security GuardDuty Hub로 전송되지 않습니다.
에서 결과 보기 GuardDuty AWS Security Hub
Security Hub에서 GuardDuty 조사 결과를 보려면 요약 페이지에서 GuardDutyAmazon의 조사 결과 보기를 선택하십시오. 또는 탐색 패널에서 검색 결과를 선택하고 값이 인 제품 이름: 필드를 선택하여 GuardDuty 검색 결과만 표시하도록 검색 결과를 필터링할 수 GuardDuty 있습니다.
에서 GuardDuty 찾은 이름 해석 AWS Security Hub
GuardDuty 보안 검색 결과 형식 (ASFF) 을 사용하여 검색 결과를AWS
Security Hub에 보냅니다. 에서 ASFF Types 필드는 검색 유형을 제공합니다. ASFF유형에는 유형과는 다른 이름 지정 체계가 사용됩니다 GuardDuty. 아래 표에는 Security Hub에 나타나는 모든 GuardDuty 검색 결과 유형과 해당 ASFF 유형이 자세히 나와 있습니다.
참고
일부 GuardDuty 검색 결과 유형의 경우 Security Hub는 ASFF ACTOR검색 결과 세부 정보의 리소스 역할 여부에 따라 다른 검색 결과 이름을 할당합니다. TARGET 자세한 정보는 결과 세부 정보 섹션을 참조하세요.
|
GuardDuty 검색 유형 |
ASFF유형 찾기 |
|---|---|
|
TTPs/Command and Control/Backdoor:EC2-C&CActivity.B |
|
|
TTPs/Command and Control/Backdoor:EC2-C&CActivity.B!DNS |
|
|
TTPs/Command and Control/Backdoor:EC2-DenialOfService.Dns |
|
|
TTPs/Command and Control/Backdoor:EC2-DenialOfService.Tcp |
|
|
TTPs/Command and Control/Backdoor:EC2-DenialOfService.Udp |
|
|
TTPs/Command and Control/Backdoor:EC2-DenialOfService.UdpOnTcpPorts |
|
|
TTPs/Command and Control/Backdoor:EC2-DenialOfService.UnusualProtocol |
|
|
TTPs/Command and Control/Backdoor:EC2-Spambot |
|
|
Unusual Behaviors/VM/Behavior:EC2-NetworkPortUnusual |
|
|
Unusual Behaviors/VM/Behavior:EC2-TrafficVolumeUnusual |
|
|
TTPs/Command and Control/Backdoor:Lambda-C&CActivity.B |
|
|
TTPs/Command and Control/Backdoor:Runtime-C&CActivity.B |
|
|
TTPs/Command and Control/Backdoor:Runtime-C&CActivity.B!DNS |
|
|
TTPs/Credential Access/IAMUser-AnomalousBehavior |
|
|
CredentialAccess:Kubernetes/AnomalousBehavior.SecretsAccessed |
TTPs/AnomalousBehavior/CredentialAccess:Kubernetes-SecretsAccessed |
| CredentialAccess:Kubernetes/MaliciousIPCaller |
TTPs/CredentialAccess/CredentialAccess:Kubernetes-MaliciousIPCaller |
| CredentialAccess:Kubernetes/MaliciousIPCaller.Custom |
TTPs/CredentialAccess/CredentialAccess:Kubernetes-MaliciousIPCaller.Custom |
| CredentialAccess:Kubernetes/SuccessfulAnonymousAccess |
TTPs/CredentialAccess/CredentialAccess:Kubernetes-SuccessfulAnonymousAccess |
| CredentialAccess:Kubernetes/TorIPCaller |
TTPs/CredentialAccess/CredentialAccess:Kubernetes-TorIPCaller |
|
TTPs/Credential Access/CredentialAccess:RDS-AnomalousBehavior.FailedLogin |
|
|
TTPs/Credential Access/RDS-AnomalousBehavior.SuccessfulBruteForce |
|
|
TTPs/Credential Access/RDS-AnomalousBehavior.SuccessfulLogin |
|
|
TTPs/Credential Access/RDS-MaliciousIPCaller.FailedLogin |
|
|
TTPs/Credential Access/RDS-MaliciousIPCaller.SuccessfulLogin |
|
|
TTPs/Credential Access/RDS-TorIPCaller.FailedLogin |
|
|
TTPs/Credential Access/RDS-TorIPCaller.SuccessfulLogin |
|
|
TTPs/Command and Control/CryptoCurrency:EC2-BitcoinTool.B |
|
|
TTPs/Command and Control/CryptoCurrency:EC2-BitcoinTool.B!DNS |
|
|
TTPs/Command and Control/CryptoCurrency:Lambda-BitcoinTool.B Effects/Resource Consumption/CryptoCurrency:Lambda-BitcoinTool.B |
|
|
TTPs/Command and Control/CryptoCurrency:Runtime-BitcoinTool.B |
|
|
TTPs/Command and Control/CryptoCurrency:Runtime-BitcoinTool.B!DNS |
|
|
TTPs/DefenseEvasion/EC2:Unusual-DNS-Resolver |
|
|
TTPs/DefenseEvasion/EC2:Unusual-DoH-Activity |
|
|
TTPs/DefenseEvasion/EC2:Unusual-DoT-Activity |
|
|
TTPs/Defense Evasion/IAMUser-AnomalousBehavior |
|
|
TTPs/DefenseEvasion/DefenseEvasion:Kubernetes-MaliciousIPCaller |
|
|
TTPs/DefenseEvasion/DefenseEvasion:Kubernetes-MaliciousIPCaller.Custom |
|
|
TTPs/DefenseEvasion/DefenseEvasion:Kubernetes-SuccessfulAnonymousAccess |
|
|
TTPs/DefenseEvasion/DefenseEvasion:Kubernetes-TorIPCaller |
|
|
TTPs/Defense Evasion/DefenseEvasion:Runtime-FilelessExecution |
|
|
TTPs/Defense Evasion/DefenseEvasion:Runtime-ProcessInjection.Proc |
|
|
TTPs/Defense Evasion/DefenseEvasion:Runtime-ProcessInjection.Ptrace |
|
|
TTPs/Defense Evasion/DefenseEvasion:Runtime-ProcessInjection.VirtualMemoryWrite |
|
|
TTPs/DefenseEvasion/DefenseEvasion:Runtime-PtraceAntiDebugging |
|
|
TTPs/DefenseEvasion/DefenseEvasion:Runtime-SuspiciousCommand |
|
|
TTPs/Discovery/IAMUser-AnomalousBehavior |
|
|
TTPs/AnomalousBehavior/Discovery:Kubernetes-PermissionChecked |
|
|
TTPs/Discovery/Discovery:Kubernetes-MaliciousIPCaller |
|
|
TTPs/Discovery/Discovery:Kubernetes-MaliciousIPCaller.Custom |
|
|
TTPs/Discovery/Discovery:Kubernetes-SuccessfulAnonymousAccess |
|
|
TTPs/Discovery/Discovery:Kubernetes-TorIPCaller |
|
|
TTPs/Discovery/RDS-MaliciousIPCaller |
|
|
TTPs/Discovery/RDS-TorIPCaller |
|
|
TTPs/Discovery:S3-AnomalousBehavior |
|
|
TTPs/Discovery:S3-BucketEnumeration.Unusual |
|
|
TTPs/Discovery:S3-MaliciousIPCaller.Custom |
|
|
TTPs/Discovery:S3-TorIPCaller |
|
|
TTPs/Discovery:S3-MaliciousIPCaller |
|
| Exfiltration:IAMUser/AnomalousBehavior |
TTPs/Exfiltration/IAMUser-AnomalousBehavior |
| Execution:Kubernetes/ExecInKubeSystemPod |
TTPs/Execution/Execution:Kubernetes-ExecInKubeSystemPod |
|
TTPs/AnomalousBehavior/Execution:Kubernetes-ExecInPod |
|
|
TTPs/AnomalousBehavior/Execution:Kubernetes-WorkloadDeployed |
|
|
TTPs/Impact/Impact:Kubernetes-MaliciousIPCaller |
|
|
TTPs/Impact/Impact:Kubernetes-MaliciousIPCaller.Custom |
|
|
TTPs/Impact/Impact:Kubernetes-SuccessfulAnonymousAccess |
|
|
TTPs/Impact/Impact:Kubernetes-TorIPCaller |
|
TTPs/Persistence/Persistence:Kubernetes-ContainerWithSensitiveMount |
|
|
Persistence:Kubernetes/AnomalousBehavior.WorkloadDeployed!ContainerWithSensitiveMount |
TTPs/AnomalousBehavior/Persistence:Kubernetes-WorkloadDeployed!ContainerWithSensitiveMount |
PrivilegeEscalation:Kubernetes/AnomalousBehavior.WorkloadDeployed!PrivilegedContainer |
TTPs/AnomalousBehavior/PrivilegeEscalation:Kubernetes-WorkloadDeployed!PrivilegedContainer |
|
TTPs/Persistence/Persistence:Kubernetes-MaliciousIPCaller |
|
|
TTPs/Persistence/Persistence:Kubernetes-MaliciousIPCaller.Custom |
|
|
TTPs/Persistence/Persistence:Kubernetes-SuccessfulAnonymousAccess |
|
|
TTPs/Persistence/Persistence:Kubernetes-TorIPCaller |
|
|
TTPs/Execution/Execution:EC2-MaliciousFile |
|
|
TTPs/Execution/Execution:ECS-MaliciousFile |
|
|
TTPs/Execution/Execution:Kubernetes-MaliciousFile |
|
|
TTPs/Execution/Execution:Container-MaliciousFile |
|
|
TTPs/Execution/Execution:EC2-SuspiciousFile |
|
|
TTPs/Execution/Execution:ECS-SuspiciousFile |
|
|
TTPs/Execution/Execution:Kubernetes-SuspiciousFile |
|
|
TTPs/Execution/Execution:Container-SuspiciousFile |
|
|
TTPs/Execution/Execution:Runtime-MaliciousFileExecuted |
|
|
TTPs/Execution/Execution:Runtime-NewBinaryExecuted |
|
|
TTPs/Execution/Execution:Runtime-NewLibraryLoaded |
|
|
TTPs/Execution/Execution:Runtime-ReverseShell |
|
|
TTPs/Execution/Execution:Runtime-SuspiciousCommand |
|
|
TTPs/Execution/Execution:Runtime-SuspiciousShellCreated |
|
|
TTPs/Execution/Execution:Runtime-SuspiciousTool |
|
|
TTPs/Exfiltration:S3-AnomalousBehavior |
|
|
TTPs/Exfiltration:S3-ObjectRead.Unusual |
|
|
TTPs/Exfiltration:S3-MaliciousIPCaller |
|
|
TTPs/Impact:EC2-AbusedDomainRequest.Reputation |
|
|
TTPs/Impact:EC2-BitcoinDomainRequest.Reputation |
|
|
TTPs/Impact:EC2-MaliciousDomainRequest.Reputation |
|
|
TTPs/Impact/Impact:EC2-PortSweep |
|
|
TTPs/Impact:EC2-SuspiciousDomainRequest.Reputation |
|
|
TTPs/Impact/Impact:EC2-WinRMBruteForce |
|
|
TTPs/Impact/IAMUser-AnomalousBehavior |
|
|
TTPs/Impact/Impact:Runtime-AbusedDomainRequest.Reputation |
|
|
TTPs/Impact/Impact:Runtime-BitcoinDomainRequest.Reputation |
|
|
TTPs/Impact/Impact:Runtime-CryptoMinerExecuted |
|
|
TTPs/Impact/Impact:Runtime-MaliciousDomainRequest.Reputation |
|
|
TTPs/Impact/Impact:Runtime-SuspiciousDomainRequest.Reputatio |
|
|
TTPs/Impact:S3-AnomalousBehavior.Delete |
|
|
TTPs/Impact:S3-AnomalousBehavior.Permission |
|
|
TTPs/Impact:S3-AnomalousBehavior.Write |
|
|
TTPs/Impact:S3-ObjectDelete.Unusual |
|
|
TTPs/Impact:S3-PermissionsModification.Unusual |
|
|
TTPs/Impact:S3-MaliciousIPCaller |
|
|
TTPs/Initial Access/IAMUser-AnomalousBehavior |
|
|
TTPs/Object/Object:S3-MaliciousFile |
|
|
TTPs/PenTest:IAMUser/KaliLinux |
|
|
TTPs/PenTest:IAMUser/ParrotLinux |
|
|
TTPs/PenTest:IAMUser/PentooLinux |
|
|
TTPs/PenTest:S3-KaliLinux |
|
|
TTPs/PenTest:S3-ParrotLinux |
|
|
TTPs/PenTest:S3-PentooLinux |
|
| TTPs/Persistence/IAMUser-AnomalousBehavior | |
|
TTPs/Persistence/Persistence:IAMUser-NetworkPermissions |
|
|
TTPs/Persistence/Persistence:IAMUser-ResourcePermissions |
|
|
TTPs/Persistence/Persistence:IAMUser-UserPermissions |
|
|
TTPs/Policy:IAMUser-RootCredentialUsage |
|
|
Software and Configuration Checks/AWS Security Best Practices/Policy:Kubernetes-AdminAccessToDefaultServiceAccount |
|
|
Software and Configuration Checks/AWS Security Best Practices/Policy:Kubernetes-AnonymousAccessGranted |
|
|
Software and Configuration Checks/AWS Security Best Practices/Policy:Kubernetes-ExposedDashboard |
|
|
Software and Configuration Checks/AWS Security Best Practices/Policy:Kubernetes-KubeflowDashboardExposed |
|
|
TTPs/Policy:S3-AccountBlockPublicAccessDisabled |
|
|
TTPs/Policy:S3-BucketAnonymousAccessGranted |
|
|
Effects/Data Exposure/Policy:S3-BucketBlockPublicAccessDisabled |
|
|
TTPs/Policy:S3-BucketPublicAccessGranted |
|
| TTPs/Privilege Escalation/IAMUser-AnomalousBehavior | |
|
TTPs/Privilege Escalation/PrivilegeEscalation:IAMUser-AdministrativePermissions |
|
PrivilegeEscalation:Kubernetes/AnomalousBehavior.RoleBindingCreated |
TTPs/AnomalousBehavior/PrivilegeEscalation:Kubernetes-RoleBindingCreated |
PrivilegeEscalation:Kubernetes/AnomalousBehavior.RoleCreated |
TTPs/AnomalousBehavior/PrivilegeEscalation:Kubernetes-RoleCreated |
|
TTPs/PrivilegeEscalation/PrivilegeEscalation:Kubernetes-PrivilegedContainer |
|
|
TTPs/Privilege Escalation/PrivilegeEscalation:Runtime-ContainerMountsHostDirectory |
|
|
TTPs/Privilege Escalation/PrivilegeEscalation:Runtime-CGroupsReleaseAgentModified |
|
|
TTPs/Privilege Escalation/PrivilegeEscalation:Runtime-DockerSocketAccessed |
|
|
TTPs/Privilege Escalation/PrivilegeEscalation:Runtime-ElevationToRoot |
|
|
TTPs/Privilege Escalation/PrivilegeEscalation:Runtime-RuncContainerEscape |
|
|
TTPs/Privilege Escalation/PrivilegeEscalation:Runtime-UserfaultfdUsage |
|
|
TTPs/Discovery/Recon:EC2-PortProbeEMRUnprotectedPort |
|
|
TTPs/Discovery/Recon:EC2-PortProbeUnprotectedPort |
|
|
TTPs/Discovery/Recon:EC2-Portscan |
|
|
TTPs/Discovery/Recon:IAMUser-MaliciousIPCaller |
|
|
TTPs/Discovery/Recon:IAMUser-MaliciousIPCaller.Custom |
|
|
TTPs/Discovery/Recon:IAMUser-NetworkPermissions |
|
|
TTPs/Discovery/Recon:IAMUser-ResourcePermissions |
|
|
TTPs/Discovery/Recon:IAMUser-TorIPCaller |
|
|
TTPs/Discovery/Recon:IAMUser-UserPermissions |
|
|
Unusual Behaviors/User/ResourceConsumption:IAMUser-ComputeResources |
|
|
TTPs/Defense Evasion/Stealth:IAMUser-CloudTrailLoggingDisabled |
|
|
TTPs/Defense Evasion/Stealth:IAMUser-LoggingConfigurationModified |
|
|
TTPs/Defense Evasion/Stealth:IAMUser-PasswordPolicyChange |
|
|
TTPs/Defense Evasion/Stealth:S3-ServerAccessLoggingDisabled |
|
|
TTPs/Command and Control/Trojan:EC2-BlackholeTraffic |
|
|
TTPs/Command and Control/Trojan:EC2-BlackholeTraffic!DNS |
|
|
TTPs/Command and Control/Trojan:EC2-DGADomainRequest.B |
|
|
TTPs/Command and Control/Trojan:EC2-DGADomainRequest.C!DNS |
|
|
TTPs/Command and Control/Trojan:EC2-DNSDataExfiltration |
|
|
TTPs/Initial Access/Trojan:EC2-DriveBySourceTraffic!DNS |
|
|
Effects/Data Exfiltration/Trojan:EC2-DropPoint |
|
|
Effects/Data Exfiltration/Trojan:EC2-DropPoint!DNS |
|
|
TTPs/Command and Control/Trojan:EC2-PhishingDomainRequest!DNS |
|
|
TTPs/Command and Control/Trojan:Lambda-BlackholeTraffic |
|
|
Effects/Data Exfiltration/Trojan:Lambda-DropPoint |
|
|
TTPs/Command and Control/Trojan:Runtime-BlackholeTraffic |
|
|
TTPs/Command and Control/Trojan:Runtime-BlackholeTraffic!DNS |
|
|
TTPs/Command and Control/Trojan:Runtime-DGADomainRequest.C!DNS |
|
|
TTPs/Initial Access/Trojan:Runtime-DriveBySourceTraffic!DNS |
|
|
Effects/Data Exfiltration/Trojan:Runtime-DropPoint |
|
|
Effects/Data Exfiltration/Trojan:Runtime-DropPoint!DNS |
|
|
TTPs/Command and Control/Trojan:Runtime-PhishingDomainRequest!DNS |
|
|
TTPs/Command and Control/UnauthorizedAccess:EC2-MaliciousIPCaller.Custom |
|
|
TTPs/UnauthorizedAccess:EC2-MetadataDNSRebind |
|
|
TTPs/Initial Access/UnauthorizedAccess:EC2-RDPBruteForce |
|
|
TTPs/Initial Access/UnauthorizedAccess:EC2-SSHBruteForce |
|
|
Effects/Resource Consumption/UnauthorizedAccess:EC2-TorClient |
|
|
Effects/Resource Consumption/UnauthorizedAccess:EC2-TorRelay |
|
|
Unusual Behaviors/User/UnauthorizedAccess:IAMUser-ConsoleLogin |
|
|
TTPs/UnauthorizedAccess:IAMUser-ConsoleLoginSuccess.B |
|
|
UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.InsideAWS |
Effects/Data Exfiltration/UnauthorizedAccess:IAMUser-InstanceCredentialExfiltration.InsideAWS |
|
UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS |
Effects/Data Exfiltration/UnauthorizedAccess:IAMUser-InstanceCredentialExfiltration.OutsideAWS |
|
TTPs/UnauthorizedAccess:IAMUser-MaliciousIPCaller |
|
|
TTPs/UnauthorizedAccess:IAMUser-MaliciousIPCaller.Custom |
|
|
TTPs/Command and Control/UnauthorizedAccess:IAMUser-TorIPCaller |
|
|
TTPs/Command and Control/UnauthorizedAccess:Lambda-MaliciousIPCaller.Custom |
|
|
Effects/Resource Consumption/UnauthorizedAccess:Lambda-TorClient |
|
|
Effects/Resource Consumption/UnauthorizedAccess:Lambda-TorRelay |
|
|
TTPs/UnauthorizedAccess:Runtime-MetadataDNSRebind |
|
|
Effects/Resource Consumption/UnauthorizedAccess:Runtime-TorRelay |
|
|
Effects/Resource Consumption/UnauthorizedAccess:Runtime-TorClient |
|
|
TTPs/UnauthorizedAccess:S3-MaliciousIPCaller.Custom |
|
|
TTPs/UnauthorizedAccess:S3-TorIPCaller |
GuardDuty의 일반적 결과
GuardDuty 보안 검색 결과 형식 (ASFF) 을 사용하여AWS Security Hub에 검색 결과를 보냅니다.
다음은 에서 찾은 일반적인 결과의 예입니다 GuardDuty.
{ "SchemaVersion": "2018-10-08", "Id": "arn:aws::guardduty:us-east-1:193043430472:detector/d4b040365221be2b54a6264dc9a4bc64/finding/46ba0ac2845071e23ccdeb2ae03bfdea", "ProductArn": "arn:aws::securityhub:us-east-1:product/aws/guardduty", "GeneratorId": "arn:aws::guardduty:us-east-1:193043430472:detector/d4b040365221be2b54a6264dc9a4bc64", "AwsAccountId": "193043430472", "Types": [ "TTPs/Initial Access/UnauthorizedAccess:EC2-SSHBruteForce" ], "FirstObservedAt": "2020-08-22T09:15:57Z", "LastObservedAt": "2020-09-30T11:56:49Z", "CreatedAt": "2020-08-22T09:34:34.146Z", "UpdatedAt": "2020-09-30T12:14:00.206Z", "Severity": { "Product": 2, "Label": "MEDIUM", "Normalized": 40 }, "Title": "199.241.229.197 is performing SSH brute force attacks against i-0c10c2c7863d1a356.", "Description": "199.241.229.197 is performing SSH brute force attacks against i-0c10c2c7863d1a356. Brute force attacks are used to gain unauthorized access to your instance by guessing the SSH password.", "SourceUrl": "https://us-east-1.console.aws.amazon.com/guardduty/home?region=us-east-1#/findings?macros=current&fId=46ba0ac2845071e23ccdeb2ae03bfdea", "ProductFields": { "aws/guardduty/service/action/networkConnectionAction/remotePortDetails/portName": "Unknown", "aws/guardduty/service/archived": "false", "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/organization/asnOrg": "CENTURYLINK-US-LEGACY-QWEST", "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/geoLocation/lat": "42.5122", "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/ipAddressV4": "199.241.229.197", "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/geoLocation/lon": "-90.7384", "aws/guardduty/service/action/networkConnectionAction/blocked": "false", "aws/guardduty/service/action/networkConnectionAction/remotePortDetails/port": "46717", "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/country/countryName": "United States", "aws/guardduty/service/serviceName": "guardduty", "aws/guardduty/service/evidence": "", "aws/guardduty/service/action/networkConnectionAction/localIpDetails/ipAddressV4": "172.31.43.6", "aws/guardduty/service/detectorId": "d4b040365221be2b54a6264dc9a4bc64", "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/organization/org": "CenturyLink", "aws/guardduty/service/action/networkConnectionAction/connectionDirection": "INBOUND", "aws/guardduty/service/eventFirstSeen": "2020-08-22T09:15:57Z", "aws/guardduty/service/eventLastSeen": "2020-09-30T11:56:49Z", "aws/guardduty/service/action/networkConnectionAction/localPortDetails/portName": "SSH", "aws/guardduty/service/action/actionType": "NETWORK_CONNECTION", "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/city/cityName": "Dubuque", "aws/guardduty/service/additionalInfo": "", "aws/guardduty/service/resourceRole": "TARGET", "aws/guardduty/service/action/networkConnectionAction/localPortDetails/port": "22", "aws/guardduty/service/action/networkConnectionAction/protocol": "TCP", "aws/guardduty/service/count": "74", "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/organization/asn": "209", "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/organization/isp": "CenturyLink", "aws/securityhub/FindingId": "arn:aws::securityhub:us-east-1::product/aws/guardduty/arn:aws::guardduty:us-east-1:193043430472:detector/d4b040365221be2b54a6264dc9a4bc64/finding/46ba0ac2845071e23ccdeb2ae03bfdea", "aws/securityhub/ProductName": "GuardDuty", "aws/securityhub/CompanyName": "Amazon" }, "Resources": [ { "Type": "AwsEc2Instance", "Id": "arn:aws::ec2:us-east-1:193043430472:instance/i-0c10c2c7863d1a356", "Partition": "aws", "Region": "us-east-1", "Tags": { "Name": "kubectl" }, "Details": { "AwsEc2Instance": { "Type": "t2.micro", "ImageId": "ami-02354e95b39ca8dec", "IpV4Addresses": [ "18.234.130.16", "172.31.43.6" ], "VpcId": "vpc-a0c2d7c7", "SubnetId": "subnet-4975b475", "LaunchedAt": "2020-08-03T23:21:57Z" } } } ], "WorkflowState": "NEW", "Workflow": { "Status": "NEW" }, "RecordState": "ACTIVE" }
통합 활성화 및 구성
와의 AWS Security Hub통합을 사용하려면 Security Hub를 활성화해야 합니다. Security Hub를 활성화하는 방법에 대한 자세한 내용은 AWS Security Hub 사용 설명서의 Security Hub 설정을 참조하세요.
Security GuardDuty Hub와 둘 다 활성화하면 통합이 자동으로 활성화됩니다. GuardDuty검색 결과를 Security Hub에 즉시 보내기 시작합니다.
Security Hub에서 GuardDuty 컨트롤 사용
AWS Security Hub 보안 제어를 사용하여 AWS 리소스를 평가하고 보안 업계 표준 및 모범 사례에 대한 규정 준수를 확인합니다. GuardDuty 리소스 및 선택한 보호 계획과 관련된 제어를 사용할 수 있습니다. 자세한 내용은 AWS Security Hub 사용 설명서의 Amazon GuardDuty 컨트롤을 참조하십시오.
AWS 서비스와 리소스의 모든 컨트롤 목록은 AWS Security Hub 사용 설명서의 Security Hub 컨트롤 참조를 참조하십시오.
Security Hub로의 결과 게시 중지
검색 결과를 Security Hub로 보내는 것을 중지하려면 Security Hub 콘솔 또는 를 사용할 수 API 있습니다.
사용 AWS Security Hub 설명서의 통합 결과 흐름 비활성화 및 활성화 (콘솔) 또는 통합 결과 흐름 비활성화 (Security HubAPI, AWS CLI) 를 참조하십시오.
