A Vanta monitor requires that GuardDuty notifications are enabled for AWS if GuardDuty is used. While this article explains what is required for the Vanta monitor to pass, please see this article from AWS for more information.

Prerequisites

• Ensure that GuardDuty is enabled for the AWS accounts and regions that you would like to enable notifications for. Please see this AWS article for more information.

Procedure

First, you'll need to create an SNS Topic and subscription:

1. Navigate to SNS in AWS here
2. Select the Topics tab on the left and then select Create topic

3. For Type, select Standard.

4. For Name, enter GuardDuty.

5. Choose Create Topic. The topic details for your new topic will open.

6. In the Subscriptions section, choose Create subscription.

7. For Protocol, choose Email.

8. For Endpoint, enter the email address to send notifications to.

9. Choose Create subscription.

10. After you create your subscription, you must confirm the subscription through email.

11. To check for a subscription message, go to your email inbox, and in the subscription message, choose Confirm subscription.

Then, you'll need to create a Cloudwatch rule that forwards Guard Duty findings to the previously created SNS topic:

1. 1. Open the CloudWatch console at https://console.aws.amazon.com/cloudwatch/.

   2. Select Rules from the navigation pane and then Create Rule.

   3. From the Service Name menu, choose GuardDuty.

   4. From the Event Type menu, choose GuardDuty Finding.

   5. In Event Pattern Preview choose Edit.

   6. Paste the below JSON code into Event Pattern Preview and choose Save

       

      {
        "source": [
          "aws.guardduty"
        ],
        "detail-type": [
          "GuardDuty Finding"
        ],
        "detail": {
          "severity": [
            4,
            4.0,
            4.1,
            4.2,
            4.3,
            4.4,
            4.5,
            4.6,
            4.7,
            4.8,
            4.9,
            5,
            5.0,
            5.1,
            5.2,
            5.3,
            5.4,
            5.5,
            5.6,
            5.7,
            5.8,
            5.9,
            6,
            6.0,
            6.1,
            6.2,
            6.3,
            6.4,
            6.5,
            6.6,
            6.7,
            6.8,
            6.9,
            7,
            7.0,
            7.1,
            7.2,
            7.3,
            7.4,
            7.5,
            7.6,
            7.7,
            7.8,
            7.9,
            8,
            8.0,
            8.1,
            8.2,
            8.3,
            8.4,
            8.5,
            8.6,
            8.7,
            8.8,
            8.9
          ]
        }
      }

      Note

      The above code will alert for any Medium to High finding.

   7. In the Targets section click Add Target.

   8. From the Select Targets menu, choose SNS Topic.

   9. For Select Topic select the name of the SNS Topic you created in Step 1.

   10. Configure the input for the event.

       • If you are setting up notifications for Chime or Slack skip to Step 11, the input type defaults to Matched event.

       • If you are setting up notifications for email via SNS follow the steps below to customize the message sent to your inbox using the following steps:

       1. Expand Configure input and then choose Input Transformer.

       2. Copy the following code and paste it into the Input Path field.

           

          
          {
              "severity": "$.detail.severity",
              "Account_ID": "$.detail.accountId",
              "Finding_ID": "$.detail.id",
              "Finding_Type": "$.detail.type",
              "region": "$.region",
              "Finding_description": "$.detail.description"
          }
                                      

       3. Copy the following code and paste it into the Input Template field to format the email.

           

          
          "AWS <Account_ID> has a severity <severity> GuardDuty finding type <Finding_Type> in the <region> region."
          "Finding Description:"
          "<Finding_description>. "
          "For more details open the GuardDuty console at https://console.aws.amazon.com/guardduty/home?region=<region>#/findings?search=id%3D<Finding_ID>"
                                      

   11. Click Configure Details.

   12. In the Configure rule details page, enter a Name and Description for the rule, and then choose Create Rule.

Common Issues

The Vanta test will not pass if:

• Your SNS topic forwards to a Lambda. Ensure that the SNS topic forwards to an email, or slack channel.
• The event pattern that you use for does not include a minimum of the following:

{ 
  "source": ["aws.guardduty"], 
  "detail-type": ["GuardDuty Finding"] 
}  

Additional Resources

• Enabling GuardDuty (AWS)
• Setting up cloudwatch rules for GuardDuty findings (AWS)