topic Ingest AWS GuardDuty logs in Cortex XDR Discussions

Ingest AWS GuardDuty logs

Antony_Chan — Tue, 24 Dec 2024 07:41:16 GMT

Dear community,

I'm seeking help to ingest AWS Guardduty logs into Cortex XDR.

I did check the documentation and only found the method to ingest AWS assets, Flow log via S3 and Route53 via S3.
I don't mind the AWS guardduty logs is not normalized, the objective is to get the logs into the Cortex XDR platform.

Appreciate if you could share your experience and knowledge.

Thank you.

Re: Ingest AWS GuardDuty logs

jmazzeo — Fri, 27 Dec 2024 17:31:34 GMT

Hi @Antony_Chan, thanks for reaching us using the Live Community.

As you noted, collecting AWS GuardDuty logs is not supported as an OOB feature, and if you can send them to XDR they will not be stitched to alerts and won't be processed by the analytics engine.

If you have Cortex XDR Pro license, you could be able to create an HTTP listener and send the logs to the tenant using a script to read the Guard Duty logs from a S3 bucket, like using Lambda to read the bucket and send the logs in JSON format to XDR. Here you can find the XDR side of the configuration requirements if you have the right license. After ingesting the logs you will need to parse them using custom parsing rules, to get the fields and store them in the dataset.

If this post answers your question, please mark it as the solution.

Re: Ingest AWS GuardDuty logs

Antony_Chan — Tue, 31 Dec 2024 01:07:45 GMT

Hello @jmazzeo ,

Thanks for the information. Yes, we do have the XDR Pro per GB license and I'm totally fine with the parsing rule as long as the logs shipped to XDR.
However, I've been wondering the difference between HTTP listener vs "ingest generic log from Amazon S3". Cause this seems to achieve the same thing.