Table: aws_guardduty_finding - Query AWS GuardDuty Findings using SQL

AWS GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior to help protect your AWS accounts and workloads. It identifies unusual or unauthorized activity, like crypto-currency mining or infrastructure deployments in a region that has never been used. GuardDuty analyzes tens of billions of events across multiple AWS data sources, such as AWS CloudTrail, Amazon VPC Flow Logs, and DNS logs.

Table Usage Guide

The aws_guardduty_finding table in Steampipe provides you with information about findings reported by AWS GuardDuty. This table allows you as a security analyst to query finding-specific details, including threat type, severity, and associated resources. You can utilize this table to gather insights on potential security threats, such as unauthorized access attempts, data breaches, or compromised instances. The schema outlines the various attributes of the GuardDuty finding for you, including the finding ID, detector ID, account ID, region, and associated tags.

Examples

Basic info

Explore which instances have been identified by AWS GuardDuty. This is useful for assessing the security findings and understanding when they were created.

select
  id,
  detector_id,
  arn,
  created_at
from
  aws_guardduty_finding;

select
  id,
  detector_id,
  arn,
  created_at
from
  aws_guardduty_finding;

List findings that are not archived

Discover the segments that consist of unarchived findings in your AWS GuardDuty. This is particularly useful in identifying active threats or issues that are yet to be addressed and archived.

select
  id,
  detector_id,
  arn,
  created_at
from
  aws_guardduty_finding
where
  service ->> 'Archived' = 'false';

select
  id,
  detector_id,
  arn,
  created_at
from
  aws_guardduty_finding
where
  json_extract(service, '$.Archived') = 'false';

Schema for aws_guardduty_finding

Name	Type	Operators	Description
_ctx	jsonb		Steampipe context in JSON form.
account_id	text	=, !=, ~~, ~~, !~~, !~~	The AWS Account ID in which the resource is located.
akas	jsonb		Array of globally unique identifier strings (also known as) for the resource.
arn	text		The Amazon Resource Name (ARN) specifying the finding.
confidence	double precision		The confidence score for the finding.
created_at	timestamp with time zone		The time and date when the finding was created.
description	text		The description of the finding.
detector_id	text	=	The ID of the detector.
id	text	=, !=	The ID of the finding.
name	text		The title of the finding.
partition	text		The AWS partition in which the resource is located (aws, aws-cn, or aws-us-gov).
region	text		The AWS Region in which the resource is located.
resource	jsonb		Contains information about the AWS resource associated with the activity that prompted GuardDuty to generate a finding.
schema_version	text		The version of the schema used for the finding.
service	jsonb		Contains additional information about the generated finding.
severity	double precision		The severity of the finding.
sp_connection_name	text	=, !=, ~~, ~~, !~~, !~~	Steampipe connection name.
sp_ctx	jsonb		Steampipe context in JSON form.
title	text		Title of the resource.
type	text	=, !=	The type of finding.
updated_at	timestamp with time zone		The time and date when the finding was last updated.

Export

This table is available as a standalone Exporter CLI. Steampipe exporters are stand-alone binaries that allow you to extract data using Steampipe plugins without a database.

You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_export_installer.sh script:

/bin/sh -c "$(curl -fsSL https://steampipe.io/install/export.sh)" -- aws

You can pass the configuration to the command with the --config argument:

steampipe_export_aws --config '<your_config>' aws_guardduty_finding