Community
Questions Library
Docs
Blog
Events
Swag
Github
Slack
JupiterOne
Discussions
Release Notes
Contact Us
Using JupiterOne for Active Vulnerability and Threat Monitoring in AWS - AskJ1 Community
<main> <article class="userContent"> <p>Active threats within an organization's AWS environments typically arise from these two main sources:</p> <ol><li>System and application vulnerabilities on EC2 instances.</li> <li>Malicious network activities, API activities and resource operations.</li> </ol><p>AWS provides two native services -- <a rel="nofollow" href="https://docs.aws.amazon.com/inspector/latest/userguide/index.html">AWS Inspector</a> and <a rel="nofollow" href="https://docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html">AWS GuardDuty</a> -- to address the above, respectively.</p> <p>Inspector performs automated scans of active EC2 instances to identify exposure and vulnerabilities.</p> <p>GuardDuty continuously analyzes network events (VPC Flow Logs and DNS logs) and API events (CloudTrail logs) to identify malicious/unauthorized activity and behavior.</p> <p>JupiterOne integrates with both AWS Inspector and GuardDuty out-of-the-box to provide a consolidated UI to manage, visualize and correlate the findings from these services.</p> <h2 data-id="accessing-the-findings-in-the-alerts-app">Accessing the Findings in the Alerts app</h2> <p>You can see all <strong>open findings</strong> in the <strong>Alerts</strong> app.</p> <p><img src="https://us.v-cdn.net/6035534/uploads/NBL4FU36OHEY/alerts-findings-grid.png" alt="alerts-findings" class="embedImage-img importedEmbed-img"></img></p> <p>Expanding a finding will give you a visual graph showing the resources the selected finding is related to. You can interact with the graph and drill down to see additional relationships and context to perform further analysis.</p> <p><img src="https://us.v-cdn.net/6035534/uploads/36BTPCT21CXT/alerts-findings-graph.png" alt="alerts-findings" class="embedImage-img importedEmbed-img"></img></p> <blockquote class="UserQuote blockquote"><div class="QuoteText blockquote-content"> <p class="blockquote-line">Note that JupiterOne also integrates with several other security scanners, including <strong>Tenable</strong>, <strong>Veracode</strong>, and <strong>WhiteHat</strong>. All security findings are aggregated in the above centralized dashboard for easy management, filtering and reporting. You can also import <strong>manual pen test findings</strong>. See <a rel="nofollow" href="https://jupiterone.vanillacommunities.com/kb/articles/943-using-jupiterone-as-a-central-repository-for-secops-and-compliance-artifacts">this doc</a> for more details.</p> </div></blockquote> <h2 data-id="correlation-and-alerting">Correlation and Alerting</h2> <p>Using J1QL, you can easily perform correlation of Inspector and GuardDuty findings and the resources they impact. For example, the following query identifies suspicious activities against any EC2 instance that also has high severity vulnerability findings.</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">Find aws_guardduty_finding that relates to aws_instance that has aws_inspector_finding with numericSeverity > 7 return tree </pre> <p>Here is an example graph returned by the above query:</p> <p><img src="https://us.v-cdn.net/6035534/uploads/D5OHO2O2SEJ5/graph-guardduty-inspector-finding-correlation.png" alt="guardduty-inspector-finding-correlation" class="embedImage-img importedEmbed-img"></img></p> <p>You can correlate Inspector and GuardDuty findings with other security scanner findings as well, if you have those integrations configured.</p> <p>You can also set up alerts and receive notification on certain findings. For example, the following query can be used to set up an alert rule for high risk findings that impact production resources:</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">Find (Host|DataStore|Application|CodeRepo|Account|Service|Network) with tag.Production=true that has Finding with severity='High' or numericSeverity>7 </pre> <p>See this alert rule in the JupiterOne <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">common-alerts</code> rule pack on <a rel="nofollow" href="https://github.com/JupiterOne/jupiterone-alert-rules/blob/master/rule-packs/common-alerts.json">Github</a>.</p> </article> </main>
.png)