Guardduty non archived findings remediation

Using Console

Using CLI

To remediate the non-archived findings enabled for GuardDuty in AWS Shield using AWS CLI, you can follow these steps:

Open the AWS CLI and run the following command to disable the non-archived findings in GuardDuty:

aws guardduty update-organization-configuration --detector-id <detector-id> --auto-enable --data-sources "s3Logs={enable=false}"

Replace <detector-id> with the ID of the GuardDuty detector for which you want to disable the non-archived findings.

Verify that the non-archived findings are disabled by running the following command:

aws guardduty get-detector --detector-id <detector-id> --query DataSources.S3Logs

This command will return the current configuration of S3 logs for the specified GuardDuty detector.

Once you have verified that the non-archived findings are disabled, you have successfully remediated the misconfiguration in AWS Shield for GuardDuty.

By following these steps, you can remediate the non-archived findings enabled for GuardDuty in AWS Shield using AWS CLI.

Using Python

To remediate the non-archived findings enabled for GuardDuty in AWS Shield using Python, you can follow these steps:

Import the necessary libraries:

import boto3

Create a Boto3 client for GuardDuty:

guardduty = boto3.client('guardduty')

List all the detectors in GuardDuty:

detectors = guardduty.list_detectors()

Iterate through each detector and update the findingPublishingFrequency to “ARCHIVE”:

for detector in detectors['DetectorIds']:
    guardduty.update_detector(
        DetectorId=detector,
        FindingPublishingFrequency='ARCHIVE'
    )

Verify that the findings are now being archived by checking the FindingPublishingFrequency of each detector:

for detector in detectors['DetectorIds']:
    response = guardduty.get_detector(
        DetectorId=detector
    )
    print(f"Detector {detector} finding publishing frequency: {response['FindingPublishingFrequency']}")

By following these steps and running the Python script, you can remediate the non-archived findings enabled for GuardDuty in AWS Shield.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Guardduty non archived findings remediation

Triage and Remediation

Remediation