Amazon GuardDuty Tester Logo

Amazon GuardDuty Tester

0
Free
Visit Website

This repository contains scripts and guidance that can be used as a proof-of-concept to generate Amazon GuardDuty findings related to real AWS resources. There are multiple tests that can be run independently or together depending on the findings you are looking to generate. These scripts do not generate examples for every possible GuardDuty finding type but do help provide insight that can help in understanding how to view and respond to GuardDuty findings for resources deployed in your environment. It is recommended that these tests be deployed in a non-production account to ensure that findings generated by these tests can be clearly identified. Additionally, the permissions to deploy these tests are quite broad and using a non-production account helps to ensure that these permissions are contained to an account where the impact of these permissions is reduced. The following tests are available in this repository: Findings related to EC2 instances and Malware protection, Findings related to EKS clusters on EC2 using Kubernetes Audit Logs and EKS Runtime protection, Generating findings related to EC2 instances and Malware protection.

FEATURES

ALTERNATIVES

Weave Scope automatically generates a map of your application for troubleshooting and monitoring Docker & Kubernetes.

A collection of tools to debug and inspect Kubernetes resources and applications, managing eBPF programs execution and mapping kernel primitives to Kubernetes resources.

A security tool to identify interesting files in AWS S3 buckets

A Lambda Function that disables AWS IAM User Access Keys after a set amount of time to reduce the risk associated with old access keys.

A set of tools for fingerprinting and exploiting Amazon cloud infrastructures

Tool for analyzing cloud resources against best practices and generating reports.

AWS Cloud Security offers security services and compliance tools for securing data and applications on AWS.

Automate AWS security checks and centralize security alerts.