GuardDuty Runtime Monitoring should be enabled
Description
This control checks whether GuardDuty Runtime Monitoring is enabled. For a standalone account, the control fails if GuardDuty Runtime Monitoring is disabled. In a multi-account environment, the control fails if the delegated GuardDuty administrator account and all member accounts do not have Runtime Monitoring enabled. GuardDuty Runtime Monitoring observes and analyzes operating system-level, networking, and file events to detect potential threats in specific AWS workloads. It utilizes GuardDuty security agents to provide visibility into runtime behavior, including file access, process execution, command line arguments, and network connections.
Remediation
To enable GuardDuty Runtime Monitoring, you need to configure the Runtime Monitoring settings in GuardDuty.
Steps
- Navigate to the Amazon GuardDuty console
- Go to 'Settings' in the left navigation
- Select 'Runtime Monitoring'
- Enable 'Runtime Monitoring'
- Configure security agents for your workloads
- Set up monitoring for EKS clusters and EC2 instances
- Save the configuration
- Verify that Runtime Monitoring is active