Received SNS Notification, but No findings in Console?

0

We received a notification via SNS of New Findings, but upon visiting the Guard Duty page, we don't see any findings reported. Also, the SNS notification does not mention the instance which generated the findings - Any pointers on how to find out the instance/service which generated these findings?

{"type": "NEW_FINDINGS",
"version": "1",
"findingDetails":[
{
"link": "https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#discovery-s3-maliciousipcaller",
"findingType": "Impact:EC2/MaliciousDomainRequest.Reputation",
"findingDescription": "An EC2 instance is querying a low reputation domain that is associated with known malicious domains."
},...
}

drl
質問済み 3年前257ビュー
1回答
1

Figured out that we had subscribed to "GuardDuty Feature Announcements" - The language in documentation was bit unclear.

For folks who run into this issue:
The right way to configure this via a rule in Cloudwatch -https://aws.amazon.com/premiumsupport/knowledge-center/guardduty-cloudwatch-sns-rule/

drl
回答済み 3年前

ログインしていません。 ログイン 回答を投稿する。

優れた回答とは、質問に明確に答え、建設的なフィードバックを提供し、質問者の専門分野におけるスキルの向上を促すものです。

質問に答えるためのガイドライン

関連するコンテンツ