High
GuardDuty
Regional
GuardDuty EKS Audit Log Monitoring should be enabled
FSBP
Description
Confirms that GuardDuty EKS Audit Log Monitoring is enabled across all accounts. This feature analyzes Kubernetes audit logs to detect suspicious activity in EKS clusters.
Remediation
To enable GuardDuty EKS Audit Log Monitoring, you need to configure the EKS protection settings in GuardDuty.
Steps
- Navigate to the Amazon GuardDuty console
- Go to 'Settings' in the left navigation
- Select 'EKS Protection'
- Enable 'EKS Audit Log Monitoring'
- Configure the monitoring settings as needed
- Save the configuration
- Verify that EKS audit log monitoring is active
Compliance
FSBP