- [Instructor] Hello everyone.
Amazon Detective automatically groups related
Amazon GuardDuty findings to help security analysts
reduce triage time and create a more comprehensive
security investigation.
Today, I'll demonstrate this feature.
Detective uses machine learning,
or ML, to group related GuardDuty findings
that, in isolation, may have been ignored
but, together, show the life cycle of a security event.
This can help security analysts identify advanced
threats more easily.
Detective finding groups enable you to examine
multiple activities as they relate
to a single security compromise event.
In a typical security event,
the threat actor attempting to compromise your
AWS environment performs a sequence
of actions that lead to multiple security findings
and unusual behaviors spread across time and resources.
When these security findings are investigated in isolation,
it can lead to a misinterpretation of their significance
and difficulty in finding the root cause.
Detective now shows groups of related GuardDuty findings,
with severity, all affected AWS accounts, and resources.
In addition, Detective maps the evolution
of the findings to tactics, techniques, and procedures
or TTPs from the major attack framework,
which is a well adopted framework
for security and threat detection.
Let us now head over to the Amazon Detective Console
and see how Detective analyzes data from findings
and groups them with other findings
that are likely to be related based
on the resources they share.
It is very valuable to investigate findings
and evidence as a group, even if the associations
made by Detective are not related.
Select "Finding groups".
On the "Finding group" page
you can see all the finding groups collected by Detective.
Here you can see the severity of a group,
title of the group, tactics observed in the group,
findings in the group, entities or resources
and AWS accounts within the group.
Select the title of the finding group
to dive deeper into the details.
The group profile page displaced the set scope time
of the group, which is the date and time
from the earliest finding or evidence included in the group
to the most recently updated finding or evidence in a group.
You can also see the finding group severity,
which is equal to the highest severity category
among the findings in the group.
The observed tactics are shown as a chain
of color dots that represents the typical progression
of a security event from the earliest to the latest stages.
This means the leftmost circles
on the chain typically represent less
severe activities where an adversary is trying to gain
or maintain access to your environment,
while activities towards the right are the most severe
and can include data tampering or destruction.
As you navigate through the involved entities
in the finding group, you will see findings
within the group that each resource is linked to.
The tags attached to each resource are also displayed
so you can quickly identify important resources
based on tagging.
Selecting on a resource will take you to its entity profile.
Similarly, you can navigate
through the involved findings in the finding group.
You will see details like finding severity,
each resource involved, and when that finding
was first and last seen.
As a part of the involved findings panel,
you may see informational findings based
on Detective's evidence from your behavior graph.
Selecting a finding in the list
opens the Findings Detail panel
with additional information about that finding.
To pivot to the GuardDuty finding page
click on the finding ID from this panel.
Thanks for your time and ensure
that you consult the Amazon Detective documentation
for more information on analyzing finding groups.