AWS Builder Center

Builder Center

How to Build an Automated Threat Detection Pipeline on AWS

How to Build an Automated Threat Detection Pipeline on AWS

Learn how to set up a real-time, serverless threat detection and alerting pipeline on AWS using CloudTrail, GuardDuty, EventBridge, and SNS.

Manual security log inspection doesn't scale. Here is how to build a real-time, serverless threat detection and alerting pipeline using core AWS security services.

Pipeline Architecture

  1. AWS CloudTrail: Captures all API activity across your AWS account.
  2. Amazon GuardDuty: Uses ML to analyze CloudTrail logs for suspicious behavior and threats.
  3. Amazon EventBridge: Filters GuardDuty security findings in real-time.
  4. Amazon SNS: Delivers instant email/Slack alerts to your security team.

Step 1: Enable Amazon GuardDuty

Navigate to GuardDuty in the AWS Console -> Click Get Started -> Click Enable GuardDuty. It immediately starts analyzing API and network logs.

Step 2: Set Up Amazon SNS Topic

  1. Go to SNS -> Topics -> Create topic (Standard type named GuardDuty-Alerts).
  2. Click Create subscription -> Select Email -> Enter your email address.
  3. Confirm the subscription link sent to your email inbox.

Step 3: Create EventBridge Routing Rule

  1. Go to EventBridge -> Rules -> Create rule (GuardDuty-High-Severity).
  2. Set event source to GuardDuty Finding.
  3. Paste this event pattern to filter Medium to High severity (Severity >= 4.0) findings:
1
2
3
4
5
6
7
{
"source": ["aws.guardduty"],
"detail-type": ["GuardDuty Finding"],
"detail": {
"severity": [4, 4.0, 5, 5.0, 6, 6.0, 7, 7.0, 8, 8.0]
}
}
# amazon-guardduty# serverless# cloud-security# security-best-practices# amazon-eventbridge
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article