- [Instructor] Welcome, everyone.
Today, I'm gonna go over a new feature for Amazon Detective
that automatically groups related GuardDuty findings
to help security analysts reduce triage time
and create a more comprehensive security investigation.
Detective uses machine learning
to group related GuardDuty findings
that in isolation may have been ignored
but together show the life cycle of an attack,
which can help security analysts
identify advanced threats more easily.
A couple things to keep in mind about this new feature
is that it is automatically enabled,
so no configuration is needed.
And it comes at no additional cost,
so you won't see any increase
in your Detective spin for this added feature.
To better understand this feature,
let's jump into the console and take a look.
As you can see, we're now on the Detective console
and the new Finding groups page.
As you can see,
it's linked on the left side of the screen.
We have one finding group that is active
in this environment.
So let's take a look at how this can help us
with security investigations.
At first glance, we can see different details,
like the severity of the finding group,
the status, the scope time,
whether there are any parent or child finding groups
and the observed tactics, techniques and procedures,
as laid out by the MITRE ATT&CK framework.
You can see in this specific finding group,
we have a tactic associated with Command and Control,
as well as another one
that is not associated with MITRE ATT&CK.
In the finding group,
we can see information related to findings
and entities associated with the findings group.
Before, we often looked at a single entity in Detective,
like a role or EC2 instance
and then used that information
to answer questions like when it was created,
related in information like trends of flow logs
or API calls.
With finding groups, Detective is now showing us
all of the listed entities
are related to the same security issue.
This is gonna reduce our time
to determine all the related resources
that are involved with an issue
and help us more quickly understand root cause
and steps needed to remediate.
As you can see, we also have the ability
to select entity from this page,
to dive deeper for a specific resource.
If we look at the findings tab,
we can see the combination of findings that occurred
which initiated this findings group.
A couple important pieces of information to point out
is that we can see the TTPs related to a finding
and all of the entities
that are associated with a given finding.
This gives us even more context
into a potential security issue without any extra work.
If we select one of these findings,
you can see that we have the context
of the GuardDuty finding on the right side of the screen.
If we pivot back to the Involved entities tab,
we can now jump into an entity
associated with this finding group,
and our example will follow the EC2 instance,
and go look at that singular entity
as we used to in Detective
and answer questions like when was this created?
Who is it created by?
What's the role associated with this EC2 instance?
And at the same time, we continue to have the context
of that GuardDuty finding on the right side of our screen
for easy reference as we continue our investigation.
So in the console, we've been able to see
what is associated with the new finding group
and how we can use these new finding groups
to better investigate a singular security issue
that might span across lots and lots of different resources.
In this video, we went over a new feature
for Amazon detective
that automatically groups related GuardDuty findings
to help security analysts reduce triage time
and create a more comprehensive security investigation.
Remember to keep in mind
that this new feature is automatically enabled,
so no configuration is needed,
and it comes at no additional costs,
so you won't see any increase in your Detective spin
with this added functionality.
If you need more information on Amazon Detective,
please visit aws.amazon.com/detective.
And to get started,
click on the link in the description below
to learn more about finding groups
or to even start a free trial with Amazon Detective.