1 new GuardDuty announcement on IAMTrail
https://iamtrail.com/guardduty
#AWS #GuardDuty
@iamtrail.bsky.social
@iamtrail.bsky.social@iamtrail.bsky.socialNew Feature on AWS GuardDuty: Amazon GuardDuty announces an expansion of RDS Protection that extends threat detection beyond login anomalies to identify data exfiltration and data https://docs.aws.amazon.com/guardduty/latest/ug/rds-protection.html
#AWS #GuardDuty #CloudSecurity
@iamtrail.bsky.social@iamtrail.bsky.socialNew AWS GuardDuty Finding: UnauthorizedAccess:IAMUser/ResourceCredentialExfiltration.InsideAWS https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#unauthorizedaccess-iam-resourcecredentialexfiltrationinsideaws
#AWS #GuardDuty #CloudSecurity
@hugovalters.bsky.socialCut GuardDuty noise from VPN egress. Use create-ip-set to add trusted IPs; the detector excludes them in Recon, UnauthorizedAccess, Backdoor.
https://www.valtersit.com/vault/add-trusted-ip-set-to-guardduty-to-reduce-false-positives-fr-3b7051/
#aws #guardduty #ValtersIT
@hugovalters.bsky.socialEnable GuardDuty S3 Protection and stream findings into Security Lake. Full CLI walkthrough:
https://www.valtersit.com/vault/configure-guardduty-s3-protection-and-export-findings-to-sec-6b0e52/
#aws #guardduty #s3-protection
@hugovalters.bsky.socialEnable GuardDuty org-wide with 2 AWS CLI calls: create-detector for your region, then update-organization-configuration sets autoEnable so new accounts get protected https://www.valtersit.com/vault/enable-guardduty-with-cli-and-autoenable-new-accounts-via-or-168ea5/ #aws #guardduty #awscli
@hugovalters.bsky.socialSilence GuardDuty noise from pen-test ranges. Create a filter that auto-archives findings matching a known CIDR via https://www.valtersit.com/vault/create-guardduty-suppression-filter-for-known-pentest-cidr-r-1657d2/ #aws #guardduty #ValtersIT
@iamtrail.bsky.social@iamtrail.bsky.socialNew Feature on AWS GuardDuty: GuardDuty Extended Threat Detection now identifies specific AI resources involved in credential-compromise attack sequences. AI Protection findings (I https://docs.aws.amazon.com/guardduty/latest/ug/extended-threat-detection.html
#AWS #GuardDuty #CloudSecurity
@hendryadrian.bsky.socialWazuh detects AWS access key compromise by correlating CloudTrail and GuardDuty across validation, enumeration, persistence, and exfiltration stages for high-confidence alerts. #Wazuh #CloudTrail #GuardDuty