Collects security findings from AWS GuardDuty threat detection service to monitor malicious activity and unauthorized behavior across your AWS environment.
Sync Type: Incremental
Details
AWS GuardDuty is a threat detection service that continuously monitors your AWS accounts and workloads for malicious activity. This input connector retrieves security findings from all GuardDuty detectors in your AWS account.
Functionality
On initialization, Monad discovers all GuardDuty detectors in the specified region. For each detector, the connector retrieves findings and maintains state to ensure incremental updates on subsequent runs. Only new findings since the last sync are collected, minimizing duplicates and API calls.
The following configuration defines the input parameters. Each field's specifications, such as type, requirements, and descriptions, are detailed below.
Settings
Setting
Type
Required
Description
Region
string
Yes
The AWS region where GuardDuty is enabled.
Role ARN
string
Yes
The ARN of the IAM role to assume for accessing GuardDuty.
Severity
string
Yes
Minimum severity level of findings to fetch. Accepts one value: Critical, High, Medium, or Low. All findings at this level and above will be collected.
Backfill Start Time
string
No
The date to start fetching data from. If not specified, no past records will be fetched.
Secrets (Static Credentials Only)
Setting
Type
Required
Description
Access Key
string
Conditional
AWS Access Key ID
Secret Key
string
Conditional
AWS Secret Access Key
⚠️ Authentication: Choose either Role ARN (recommended) or static credentials. See AWS Authentication Guide for setup instructions.
