Amazon GuardDuty

Overview

Findings from Amazon's native threat detection service, GuardDuty, expand FortiCNAPP's detection capabilities. FortiCNAPP collects GuardDuty findings through AWS Security Hub, correlates the entities in its graph-based known and unknown threat detection system, and displays relevant GuardDuty findings as Supporting Facts in FortiCNAPP Composite Alerts. This integration automates the evidence-gathering phase of incident investigations, providing security analysts with high-efficacy, low-volume alerts.

Prerequisites

• Enable Amazon GuardDuty - Follow the AWS documentation to enable Amazon GuardDuty in your AWS account.
• Enable AWS Security Hub - Follow the AWS documentation to enable AWS Security Hub in your AWS account.
• A Cloud Security Platform SaaS account.
• Ensure that you are deploying the integration to a supported AWS region.

When Amazon GuardDuty and AWS Security Hub are enabled, GuardDuty automatically sends findings to AWS Security Hub.

Amazon GuardDuty Integration Architecture

CloudFormation is used to deploy the Amazon GuardDuty integration. The CloudFormation template creates the following resources:

• An EventBridge rule that forwards GuardDuty findings to an SQS queue.
• An SQS queue that receives the GuardDuty findings.
• A cross-account IAM role that allows FortiCNAPP to access the SQS queue in order to receive the GuardDuty findings.

Configure the Amazon GuardDuty Integration

In the Console you can either Run the CloudFormation Template or Download the CloudFormation Template.

• Run CloudFormation Template - This option requires fewer steps and less user interaction. Disable your browser pop-up blocker.
• Download CloudFormation Template - This option requires more user interaction but may be useful if you have multiple accounts with distributed ownership.

  Run CloudFormation:

1. Log in to the Console.
2. Go to Settings > Integrations > Cloud account.
3. Click + Add New.
4. Click Amazon Web Services and select CloudFormation.
5. Click Next.
6. Select Security Hub and click Run CloudFormation Template. If you are already logged in to your AWS account, this redirects you to the Create stack page. The template populates the Amazon S3 template URL for you.
7. No changes are required. Click Next.
8. Review the Specify stack details page. Resource name prefix is populated with the account name of the first account configured to use FortiCNAPP for AWS Configuration. When adding accounts, you can keep this prefix or enter a different prefix to ensure account uniqueness. Click Next.
9. No changes are required on the Configure stack options page. Click Next.
10. Verify the information on the Review page and click Submit.

Download CloudFormation:

1. Log in to the Console.
2. Go to Settings > Integrations > Cloud account.
3. Click + Add New.
4. Click Amazon Web Services and select CloudFormation.
5. Click Next.
6. Select Security Hub and click Download CloudFormation Template.
7. Log in to your AWS account.
8. Select the CloudFormation service and click Create stack. The Create stack page displays.
9. For Template source, click Upload a template file.
10. Upload the FortiCNAPP template and click Next.
11. On the Specify stack details page enter a Stack name (for example, FortiCNAPP-Amazon-GuardDuty).
12. Enter a Resource name prefix such as an account name. Click Next.
13. No changes are required on the Configure stack options page. Click Next.
14. Verify the information on the Review page and click Submit.

For more information on selecting a stack template, refer to AWS documentation.

CloudFormation Stack Progress

After clicking Submit, you are redirected back to the CloudFormation page.

If you do not see your new stack in the table, refresh the page. Select your stack to see the event log as it is being created. When the stack is CREATE-COMPLETE, the Amazon GuardDuty integration is complete.

Permissions

The following IAM permissions are required to allow FortiCNAPP to receive GuardDuty findings. These are provisioned as part of the CloudFormation deployment.

Cross-Account IAM Role

  LaceworkSecHubCrossAccountAccessRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "${ResourceNamePrefix}-Lacework-Sec-Hub-Role"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - sts:AssumeRole
            Principal:
               AWS: !Join
                  - ''
                  - - 'arn:aws:iam::'
                    - !Ref LaceworkAWSAccountId
                    - ':role/Lacework-platform'
            Condition:
              StringEquals:
                sts:ExternalId:
                  !Ref ExternalID
      Path: "/"
      Policies:
        - PolicyName: LaceworkSecHubCrossAccountAccessRolePolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - sqs:ListQueues
                  - sqs:GetQueueAttributes
                  - sqs:GetQueueUrl
                  - sqs:DeleteMessage
                  - sqs:ReceiveMessage
                Resource:
                  - !GetAtt LaceworkSecHubQueue.Arn

FAQs

How do I know if the integration is working?

After configuring the Security Hub integration, the status in FortiCNAPP will show Pending until a new event is generated by Security Hub and delivered to FortiCNAPP. The status will then show Success. If there is an issue, you will see an error message.

Where can I see the GuardDuty findings in FortiCNAPP?

GuardDuty findings are only displayed when they correlate with a composite alert.