Skip to main content

💼 [GuardDuty.1] GuardDuty should be enabled

  • Contextual name: 💼 [GuardDuty.1] GuardDuty should be enabled
  • ID: /frameworks/aws-fsbp-v1.0.0/guardduty/01
  • Located in: 💼 GuardDuty

Description​

It is highly recommended that you enable GuardDuty in all supported AWS Regions. Doing so allows GuardDuty to generate findings about unauthorized or unusual activity, even in Regions that you do not actively use. This also allows GuardDuty to monitor CloudTrail events for global AWS services such as IAM.

Similar​

Similar Sections (Give Policies To)​

SectionSub SectionsInternal RulesPoliciesFlags
💼 NIST SP 800-53 Revision 5 → 💼 AC-2(12) Account Management _ Account Monitoring for Atypical Usage
💼 NIST SP 800-53 Revision 5 → 💼 AU-6(1) Audit Record Review, Analysis, and Reporting _ Automated Process Integration11
💼 NIST SP 800-53 Revision 5 → 💼 AU-6(5) Audit Record Review, Analysis, and Reporting _ Integrated Analysis of Audit Records
💼 NIST SP 800-53 Revision 5 → 💼 CA-7 Continuous Monitoring610
💼 NIST SP 800-53 Revision 5 → 💼 CM-8(3) System Component Inventory _ Automated Unauthorized Component Detection
💼 NIST SP 800-53 Revision 5 → 💼 RA-3(4) Risk Assessment _ Predictive Cyber Analytics
💼 NIST SP 800-53 Revision 5 → 💼 SA-8(19) Security and Privacy Engineering Principles _ Continuous Protection
💼 NIST SP 800-53 Revision 5 → 💼 SA-8(21) Security and Privacy Engineering Principles _ Self-analysis
💼 NIST SP 800-53 Revision 5 → 💼 SA-8(25) Security and Privacy Engineering Principles _ Economic Security
💼 NIST SP 800-53 Revision 5 → 💼 SA-11(1) Developer Testing and Evaluation _ Static Code Analysis
💼 NIST SP 800-53 Revision 5 → 💼 SA-11(6) Developer Testing and Evaluation _ Attack Surface Reviews
💼 NIST SP 800-53 Revision 5 → 💼 SA-15(2) Development Process, Standards, and Tools _ Security and Privacy Tracking Tools
💼 NIST SP 800-53 Revision 5 → 💼 SA-15(8) Development Process, Standards, and Tools _ Reuse of Threat and Vulnerability Information
💼 NIST SP 800-53 Revision 5 → 💼 SC-5 Denial-of-service Protection35
💼 NIST SP 800-53 Revision 5 → 💼 SC-5(1) Denial-of-service Protection _ Restrict Ability to Attack Other Systems
💼 NIST SP 800-53 Revision 5 → 💼 SC-5(3) Denial-of-service Protection _ Detection and Monitoring
💼 NIST SP 800-53 Revision 5 → 💼 SI-3(8) Malicious Code Protection _ Detect Unauthorized Commands5
💼 NIST SP 800-53 Revision 5 → 💼 SI-4 System Monitoring2518
💼 NIST SP 800-53 Revision 5 → 💼 SI-4(1) System Monitoring _ System-wide Intrusion Detection System
💼 NIST SP 800-53 Revision 5 → 💼 SI-4(2) System Monitoring _ Automated Tools and Mechanisms for Real-time Analysis
💼 NIST SP 800-53 Revision 5 → 💼 SI-4(4) System Monitoring _ Inbound and Outbound Communications Traffic11
💼 NIST SP 800-53 Revision 5 → 💼 SI-4(5) System Monitoring _ System-generated Alerts
💼 NIST SP 800-53 Revision 5 → 💼 SI-4(13) System Monitoring _ Analyze Traffic and Event Patterns
💼 NIST SP 800-53 Revision 5 → 💼 SI-4(22) System Monitoring _ Unauthorized Network Services
💼 NIST SP 800-53 Revision 5 → 💼 SI-4(25) System Monitoring _ Optimize Network Traffic Analysis
💼 NIST SP 800-53 Revision 5 → 💼 SI-20 Tainting
💼 PCI DSS v3.2.1 → 💼 11.4 Use intrusion-detection and/or intrusion-prevention techniques to detect and/or prevent intrusions into the network.18
💼 PCI DSS v3.2.1 → 💼 11.5.1 Implement a process to respond to any alerts generated by the change detection solution.

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlags