Skip to main content

Posts

Integration with Amazon GuardDuty

What is Amazon GuardDuty?
Amazon GuardDuty is a continuous security monitoring platform that analyzes and processes VPC flow logs, AWS CloudTrail event logs and DNS logs. It uses threat intelligence feeds, such as lists of malicious IPs and domains to identify malicious activity within your AWS environment.
You can enable the GuardDuty Service through your Amazon Console. Once there, you are then presented with the GuardDuty dashboard, as shown in the example below:














Finding are rated as High, Medium or Low on the dashboard and have the following meaning:  

Highfindingsindicates that the resource in question is compromised and is actively being used for unauthorized purposes.

Medium findings indicates suspicious activity, for example, a large amount of traffic being returned to a remote host that is hiding behind the Tor network.

Low findingsindicates suspicious or malicious activity that was blocked before it compromised your resource.

Integrating CloudHunter with GuardDuty

CloudHunter integr…
Recent posts

The Cloud Attack Chain

In an earlier posting on Public Cloud Security Detection Use Cases, we attempted to map
detections to the traditional Lockheed Martin Kill Chain. After further reflection,
we decided that cloud infrastructure threats are sufficiently different enough to warrant a
modified attack chain framework. We are releasing the Cloud Attack Chain framework today. The Cloud Attack Chain is a simplified attack chain model that describes typical attacks on public cloud
infrastructure.  The attack chain describes how an attacker gains access to a victim’s cloud environment, how
they move laterally through the target cloud infrastructure, and what malicious actions they perform.   Our
new Whitepaper describes the four stages of the attack chain and provides detailed examples of some real-world
attacks.  

As a preview, the stages of the Cloud Attack Chain are:

1. Exposure: Exposure of cloud resources is at the beginning of any cloud attack. Exposure can be deliberate,
based on business trade-offs, or acci…

AWS ECS Integration

CloudHunter Amazon ECS Integration

Sift Security CloudHunter integrates with Amazon EC2 Container Service (ECS) to enable improved visibility and enhance detection, threat hunting, and incident response capabilities.  For ECS instances, CloudHunter provides high-fidelity anomaly detection results to identify potentially compromised instances. CloudHunter considers the quality of the baseline when determining how to prioritize alerts. Because containers are generally single-purpose and homogeneous, they have highly predictable baselines, from which CloudHunter can easily identify and prioritize abnormal behavior. CloudHunter also provides useful visualizations around ECS Instances, such as which auto scaling groups and images they are created from, and what users are responsible for any changes made to them.  

The screenshot below shows CloudHunter being used to investigate a compromised ECS instance.  The graph shows all the instances of a container, with an alert for one of the nine in…

Integrating with Amazon Inspector

Sift Security CloudHunter integrates with Amazon Inspector to enable enhanced detection, threat hunting, and accelerated incident response. Integrating AWS Inspector with CloudHunter allows organizations to take advantage of an additional security in the cloud. With AWS inspector you can: periodic files scans to identify misconfigurationsScan for insecure network protocolsScans application processes for bad default settingsScans for authentication best practices on AMI accounts.Scan installed operating system packages for a pre-determined list of CVEs
Key Features Dashboards summarize the total number of vulnerabilities, the instances with the most vulnerabilities, and other context about vulnerabilities found by your scanner.

Effective Management of Security Incidents

You'll be excited to hear that we released an additional tab under the Risks view of our product, to enable Incident Management. The Incidents tab surfaces the highest fidelity alerts that should be prioritized in terms of investigations and/or proactive hunting and enables management of those incidents.


Here's what you need to know about this new tab: What are the Key features?Visualization - dashboards and tables summarizing incidents Creation - create/edit incidents, manually or automatically Notification - set up notification options (Ticketing, Slack, Email,