HackBlue

Tools · Workbench

AWS detection and investigation

Lessons on Amazon GuardDuty and CloudTrail Lake: triaging findings, routing and suppressing them safely, and reconstructing what a leaked credential did.

  • 4 lessons
  • 46 min of reading
  • 2 topics
Start with lesson 1All workbenches

GuardDuty says something looks wrong; CloudTrail says exactly what happened. These lessons move from a finding to the API calls behind it, and from those calls to containment and a fix list.

Work in a sandbox account you own. Sample findings let you practise triage without an incident, and both services bill by volume, so clean up when you finish.

GuardDuty

2 lessons

  1. 01GuardDuty triage: read a finding from type name to next actionGenerate GuardDuty sample findings in a sandbox account, decode a finding type name, and work through resource, actor, and timing fields with the AWS CLI to decide whether to contain or close.12 min
  2. 02GuardDuty at scale: delegated admin, suppression rules, and EventBridge routingManage GuardDuty from a delegated administrator account, write a narrow suppression rule for a known benign pattern, and route high-severity findings to the on-call channel through EventBridge.11 min

CloudTrail Lake

2 lessons

  1. 01CloudTrail Lake: create an event data store and answer questions in SQLCreate a CloudTrail Lake event data store in a sandbox account, run SQL queries with the AWS CLI, and read the results to see who made failed calls and which principals created access keys.11 min
  2. 02CloudTrail Lake investigation: everything one leaked role session didFollow a GuardDuty credential-exfiltration finding into CloudTrail Lake, list every call made with the leaked access key, and check for persistence such as new users, keys, or role trust changes.12 min