Question

A security engineer at a financial services company wants Amazon GuardDuty to generate findings whenever EC2 instances communicate with a specific set of IP addresses that the company's own threat intelligence team has identified as malicious command-and-control servers. These IPs are not yet part of any AWS-managed threat list. The engineer needs GuardDuty to flag this traffic automatically going forward. What should the engineer do?

Accepted Answer

Create a threat list (threat IP set) in GuardDuty and upload the company's malicious IP addresses so GuardDuty generates findings on traffic to or from them.

Answer

Upload a trusted IP list to GuardDuty containing the malicious IP addresses so they are monitored more closely.

Answer

Add the IP addresses to a VPC network ACL deny rule, which will automatically forward blocked-connection events to GuardDuty.

Answer

Create a Security Hub custom insight that matches the malicious IPs and enable it to feed detections back into GuardDuty.