Ingest AWS GuardDuty logs

[Antony_Chan]

Dear community,

I'm seeking help to ingest AWS Guardduty logs into Cortex XDR.

I did check the documentation and only found the method to ingest AWS assets, Flow log via S3 and Route53 via S3. 
I don't mind the AWS guardduty logs is not normalized, the objective is to get the logs into the Cortex XDR platform.

Appreciate if you could share your experience and knowledge.

Thank you. Cortex XDR AWS 

[jmazzeo]

Hi @Antony_Chan, thanks for reaching us using the Live Community.

As you noted, collecting AWS GuardDuty logs is not supported as an OOB feature, and if you can send them to XDR they will not be stitched to alerts and won't be processed by the analytics engine.

If you have Cortex XDR Pro license, you could be able to create an HTTP listener and send the logs to the tenant using a script to read the Guard Duty logs from a S3 bucket, like using Lambda to read the bucket and send the logs in JSON format to XDR. Here you can find the XDR side of the configuration requirements if you have the right license. After ingesting the logs you will need to parse them using custom parsing rules, to get the fields and store them in the dataset.

If this post answers your question, please mark it as the solution.