Fortinet black logo

AWS Administration Guide

Parameters

Copy Link
Copy Doc ID 94c869ba-eb59-11ed-8e6d-fa163e15d75b:630538
Download PDF

Parameters

GuardDuty findings give visibility on the following:

  • Severity: high/medium/low (associated with scores)
  • Where the behavior/activity occurred: Region, resource ID, account ID
  • When: last seen date/time
  • Count
  • Detailed information
    • Affected resource: type/instance ID/image ID/port/resource type/image description/launch time/tags/network interfaces (public IP, private IP, subnet ID, VPC ID, security groups)
    • Action: type/connection direction
    • Actor
    • Additional

    For more information about Amazon GuardDuty, see the Amazon GuardDuty official website.

    There are five configurable environment variables in the Lambda function:

    Variable name

    Type

    Description

    MIN_SEVERITY

    Integer

    The minimum severity to block an IP address. Defaults to 3. Value ranges from 1 to 10 by AWS GuardDuty definition.

    S3_BUCKET

    Text

    S3 bucket name to store the IP block list file. No default value. Must specify.

    S3_BLOCKLIST_KEY

    Text

    Path to the IP block list file within the S3 bucket. No default value. Must specify. The relative file path to the S3 bucket.

    REGION

    Text

    AWS region to run Lambda, DynamoDB services. Must specify.

    DDB_TABLE_NAME

    Text

    DynamoDB table name which stores malicious IP addresses from findings. Must specify.

Parameters

GuardDuty findings give visibility on the following:

  • Severity: high/medium/low (associated with scores)
  • Where the behavior/activity occurred: Region, resource ID, account ID
  • When: last seen date/time
  • Count
  • Detailed information
    • Affected resource: type/instance ID/image ID/port/resource type/image description/launch time/tags/network interfaces (public IP, private IP, subnet ID, VPC ID, security groups)
    • Action: type/connection direction
    • Actor
    • Additional

    For more information about Amazon GuardDuty, see the Amazon GuardDuty official website.

    There are five configurable environment variables in the Lambda function:

    Variable name

    Type

    Description

    MIN_SEVERITY

    Integer

    The minimum severity to block an IP address. Defaults to 3. Value ranges from 1 to 10 by AWS GuardDuty definition.

    S3_BUCKET

    Text

    S3 bucket name to store the IP block list file. No default value. Must specify.

    S3_BLOCKLIST_KEY

    Text

    Path to the IP block list file within the S3 bucket. No default value. Must specify. The relative file path to the S3 bucket.

    REGION

    Text

    AWS region to run Lambda, DynamoDB services. Must specify.

    DDB_TABLE_NAME

    Text

    DynamoDB table name which stores malicious IP addresses from findings. Must specify.