AWS GuardDuty integration with PagerDuty

Question

I want to integrate my AWS GuardDuty alerts with cloudwatch so that I get such alerts on my PagerDuty if there is any threats…is there any way to do so?

Answer

Hi,
PagerDuty has a comprehensive doc for this purpose. 
See https://support.pagerduty.com/docs/aws-guardduty-integration-guide

and a video

https://www.youtube.com/watch?v=XOq_DYbBL08

Finally, full implementation guide on AWS with ControlTower: https://d1.awsstatic.com/Marketplace/solutions-center/downloads/AWS-Control-Tower-Implementation-Guide-PagerDuty.pdf

Answer

Simply, To send alerts to PagerDuty, you need to use SNS which PagerDuty is subscribed with a HTTPS subscription.

Within the PagerDuty, within each service you wish to receive alerts on you will need to configure an AWS integration. This provides the https subscription url to add to SNS.

Add this url in SNS topic subscription.

I do the same for cloudwatch alarms to page our call team.

Ensure appropriate guard duty findings trigger an sns notification.

AWS GuardDuty integration with PagerDuty

Relevanter Inhalt