Turn on threat detection in every account

How to do it

Use the provider's service, such as Amazon GuardDuty, Google Security Command Center or Microsoft Defender for Cloud. It reads the audit log, DNS queries and network flows, and flags stolen keys, crypto mining and calls from known bad addresses. Turn it on from the account baseline with one delegated admin account for the organization. Route findings by severity to the same pager as other alerts, as in the operations playbook. Close or suppress each finding with a written reason. Route the findings as Page only for what cannot wait says.

Examples

Terraform example

resource "aws_guardduty_detector" "baseline" {
  enable = true
}

resource "aws_cloudwatch_event_rule" "high_findings" {
  name = "guardduty-high-findings"
  event_pattern = jsonencode({
    source        = ["aws.guardduty"]
    "detail-type" = ["GuardDuty Finding"]
    detail        = { severity = [{ numeric = [">=", 7] }] }
  })
}

Shell example

# Run in a sandbox account. The on-call alert must arrive within 15 minutes.
aws guardduty create-sample-findings --detector-id "$(aws guardduty list-detectors --query 'DetectorIds[0]' --output text)"

How to check

Every account and region in use reports the detector as enabled. Create sample findings in a sandbox account, and the on-call alert arrives within 15 minutes.

Sources

• Amazon GuardDuty Regions and endpoints

Related rules

• INF-14 Start every account from one baseline in Infrastructure and environments
• OPS-20 Page only for what cannot wait in Operations and observability