Les traductions sont fournies par des outils de traduction automatique. En cas de conflit entre le contenu d'une traduction et celui de la version originale en anglais, la version anglaise prévaudra.

# GuardDuty intégration aux services AWS de sécurité
<a name="guardduty_integrations"></a>

GuardDuty peut être intégré à d'autres services AWS de sécurité. Ces services peuvent ingérer des données pour vous GuardDuty permettre de visualiser les résultats de nouvelles manières. Consultez les options d'intégration suivantes pour en savoir plus sur la façon dont ce service est configuré pour fonctionner avec GuardDuty.

## Intégration GuardDuty avec AWS Security Hub CSPM
<a name="gd-securityhub"></a>

AWS Security Hub CSPM collecte des données de sécurité provenant de vos AWS comptes, de vos services et des produits partenaires tiers pris en charge afin d'évaluer l'état de sécurité de votre environnement conformément aux normes du secteur et aux meilleures pratiques. Outre l'évaluation de votre niveau de sécurité, Security Hub CSPM crée un emplacement central pour les résultats de tous vos AWS services intégrés et produits AWS partenaires. L'activation de Security Hub CSPM GuardDuty permettra automatiquement aux données de GuardDuty résultats d'être ingérées par Security Hub CSPM. 

 Pour plus d'informations sur l'utilisation de Security Hub CSPM avec GuardDuty , voir. [Intégration avec AWS Security Hub CSPM](securityhub-integration.md) 

## Intégration GuardDuty à Amazon Detective
<a name="gd-detective"></a>

Amazon Detective utilise les données de journal de tous vos AWS comptes pour créer des visualisations de données pour vos ressources et adresses IP qui interagissent avec votre environnement. Les visualisations de Detective vous aident à enquêter rapidement et facilement sur les problèmes de sécurité. Vous pouvez passer de la GuardDuty recherche de détails à la recherche d'informations dans la console Detective une fois les deux services activés. 

 Pour plus d'informations sur l'utilisation de Detective avec, GuardDuty voir[Intégration à Amazon Detective](detective-integration.md). 

# Intégration avec AWS Security Hub CSPM
<a name="securityhub-integration"></a>

[AWS Security Hub CSPM](https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html) fournit une vue complète de votre état de sécurité dans AWS et vous permet de vérifier votre environnement par rapport aux normes et aux bonnes pratiques du secteur de la sécurité. Security Hub CSPM collecte des données de sécurité provenant de AWS comptes, de services et de produits partenaires tiers pris en charge et vous aide à analyser vos tendances en matière de sécurité et à identifier les problèmes de sécurité les plus prioritaires.

L' GuardDuty intégration d'Amazon à Security Hub CSPM vous permet d'envoyer des résultats depuis GuardDuty Security Hub CSPM. Security Hub CSPM peut ensuite inclure ces résultats dans son analyse de votre posture de sécurité.

**Contents**
+ [Comment Amazon GuardDuty envoie ses résultats à AWS Security Hub CSPM](#securityhub-integration-sending-findings)
  + [Types de résultats GuardDuty envoyés au Security Hub CSPM](#securityhub-integration-finding-types)
    + [Latence pour l'envoi de nouvelles découvertes](#securityhub-integration-finding-latency)
    + [Réessayer lorsque Security Hub CSPM n'est pas disponible](#securityhub-integration-retry-send)
    + [Mise à jour des résultats existants dans Security Hub CSPM](#securityhub-integration-finding-updates)
+ [Afficher GuardDuty les résultats dans AWS Security Hub CSPM](#findings-in-securityhub)
  + [Interprétation GuardDuty de la recherche de noms dans AWS Security Hub CSPM](#interpreting-findings-in-securityhub)
  + [Constatation typique tirée de GuardDuty](#securityhub-integration-finding-example)
+ [Activation et configuration de l'intégration](#securityhub-integration-enable)
+ [Utilisation GuardDuty des contrôles dans Security Hub CSPM](#securityhub-integration-using-guardduty-controls)
+ [Arrêt de la publication des résultats sur Security Hub CSPM](#securityhub-integration-disable)

## Comment Amazon GuardDuty envoie ses résultats à AWS Security Hub CSPM
<a name="securityhub-integration-sending-findings"></a>

Dans AWS Security Hub CSPM, les problèmes de sécurité sont suivis sous forme de découvertes. Certains résultats proviennent de problèmes détectés par d'autres AWS services ou par des partenaires tiers. Security Hub CSPM dispose également d'un ensemble de règles qu'il utilise pour détecter les problèmes de sécurité et générer des résultats.

Security Hub CSPM fournit des outils permettant de gérer les résultats provenant de toutes ces sources. Vous pouvez afficher et filtrer les listes de résultats et afficher les informations sur un résultat. Pour de plus amples informations, consultez la section [Viewing findings](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-findings-viewing.html) (Affichage des résultats) dans le *Guide de l'utilisateur AWS Security Hub *. Vous pouvez également suivre le statut d'une analyse dans un résultat. Pour de plus amples informations, veuillez consulter [Prendre des mesure en fonction des résultats](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-findings-taking-action.html) dans le *Guide de l'utilisateur AWS Security Hub *.

Tous les résultats du Security Hub CSPM utilisent un format JSON standard appelé AWS Security Finding Format (ASFF). Le format ASFF comprend des informations sur la source du problème, les ressources affectées et le statut actuel du résultat. Consultez [AWS Security Finding Format (ASFF)](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-findings-format.html) dans le *Guide de l'utilisateur AWS Security Hub *.

Amazon GuardDuty est l'un des AWS services qui envoie les résultats à Security Hub CSPM.

### Types de résultats GuardDuty envoyés au Security Hub CSPM
<a name="securityhub-integration-finding-types"></a>

Une fois que vous avez GuardDuty activé Security Hub CSPM sur le même compte au sein du même compte Région AWS, vous commencez GuardDuty à envoyer tous les résultats générés à Security Hub CSPM. Ces résultats sont envoyés au Security Hub CSPM à l'aide du format [ASFF (AWS Security Finding Format)](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-findings-format.html). Dans le format ASFF, le champ `Types` fournit le type de résultat.

#### Latence pour l'envoi de nouvelles découvertes
<a name="securityhub-integration-finding-latency"></a>

Lors de GuardDuty la création d'un nouveau résultat, il est généralement envoyé au Security Hub CSPM dans les cinq minutes.

#### Réessayer lorsque Security Hub CSPM n'est pas disponible
<a name="securityhub-integration-retry-send"></a>

Si Security Hub CSPM n'est pas disponible, GuardDuty réessaie d'envoyer les résultats jusqu'à ce qu'ils soient reçus.

#### Mise à jour des résultats existants dans Security Hub CSPM
<a name="securityhub-integration-finding-updates"></a>

Après avoir envoyé un résultat à Security Hub CSPM, il GuardDuty envoie des mises à jour pour refléter les observations supplémentaires concernant l'activité de recherche à Security Hub CSPM. Les nouvelles observations relatives à ces résultats sont envoyées au Security Hub CSPM en fonction des [Étape 5 — Fréquence d'exportation des résultats](guardduty_exportfindings.md#guardduty_exportfindings-frequency) paramètres de votre. Compte AWS

Lorsque vous archivez ou désarchivez un résultat, GuardDuty il ne l'envoie pas au Security Hub CSPM. Toute découverte désarchivée manuellement qui devient ensuite active dans n' GuardDuty est pas envoyée au Security Hub CSPM.

## Afficher GuardDuty les résultats dans AWS Security Hub CSPM
<a name="findings-in-securityhub"></a>

Connectez-vous à la AWS Security Hub CSPM console AWS Management Console et ouvrez-la à l'adresse [https://console.aws.amazon.com/securityhub/](https://console.aws.amazon.com/securityhub/).

Vous pouvez désormais utiliser l'une des méthodes suivantes pour afficher les GuardDuty résultats dans la console Security Hub CSPM :

**Option 1 : utilisation des *intégrations* dans Security Hub CSPM**  

1. Dans le volet de navigation de gauche, choisissez **Integrations.**

1. Sur la page **Intégrations**, vérifiez le **statut d'****Amazon : GuardDuty**. 
   + Si le **statut** est **Acceptation des résultats**, choisissez **Voir les résultats** à côté de **Accepter les résultats**. 
   + *Si ce n'est pas le cas, pour plus d'informations sur le fonctionnement **des intégrations**, consultez la section [Intégrations CSPM de Security Hub dans le guide de l'utilisateur](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-findings-providers.html).AWS Security Hub *

**Option 2 : utilisation des *résultats* dans Security Hub CSPM**  

1. Dans le volet de navigation de gauche, sélectionnez **Findings**.

1. Sur la page **Résultats**, ajoutez le **nom du produit du** filtre et entrez **GuardDuty** pour afficher uniquement GuardDuty les résultats.

### Interprétation GuardDuty de la recherche de noms dans AWS Security Hub CSPM
<a name="interpreting-findings-in-securityhub"></a>

GuardDuty envoie les résultats à Security Hub CSPM en utilisant le format [ASFF (AWS Security Finding Format)](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-findings-format.html). Dans le format ASFF, le champ `Types` fournit le type de résultat. Les types ASFF utilisent un schéma de dénomination différent de celui des GuardDuty types. Le tableau ci-dessous détaille tous les types de GuardDuty recherche avec leur équivalent ASFF tels qu'ils apparaissent dans Security Hub CSPM. 

**Note**  
****Pour certains types de GuardDuty recherche, Security Hub CSPM attribue des noms de recherche ASFF différents selon que le **rôle de ressource** du détail de la recherche était ACTOR ou TARGET.**** Pour de plus amples informations, veuillez consulter [Détails d'un résultat](guardduty_findings-summary.md).


|  GuardDuty type de recherche  |  Type de résultat ASFF  | 
| --- | --- | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-attack-sequence-finding-types.html#attack-sequence-iam-compromised-credentials](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-attack-sequence-finding-types.html#attack-sequence-iam-compromised-credentials)  |  TTPs/AttackSequence:IAM/CompromisedCredentials   | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-attack-sequence-finding-types.html#attack-sequence-s3-compromised-data](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-attack-sequence-finding-types.html#attack-sequence-s3-compromised-data)  |  TTPs/AttackSequence:S3/CompromisedData   | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#backdoor-ec2-ccactivityb](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#backdoor-ec2-ccactivityb)  |  TTPs/Command and Control/Backdoor:EC2-C&CActivity.B  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#backdoor-ec2-ccactivitybdns](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#backdoor-ec2-ccactivitybdns)  |  TTPs/Command and Control/Backdoor:EC2-C&CActivity.B\$1DNS  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#backdoor-ec2-denialofservicedns](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#backdoor-ec2-denialofservicedns)  |  TTPs/Command and Control/Backdoor:EC2-DenialOfService.Dns  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#backdoor-ec2-denialofservicetcp](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#backdoor-ec2-denialofservicetcp)  |  TTPs/Command and Control/Backdoor:EC2-DenialOfService.Tcp  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#backdoor-ec2-denialofserviceudp](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#backdoor-ec2-denialofserviceudp)  |  TTPs/Command and Control/Backdoor:EC2-DenialOfService.Udp  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#backdoor-ec2-denialofserviceudpontcpports](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#backdoor-ec2-denialofserviceudpontcpports)  |  TTPs/Command and Control/Backdoor:EC2-DenialOfService.UdpOnTcpPorts  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#backdoor-ec2-denialofserviceunusualprotocol](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#backdoor-ec2-denialofserviceunusualprotocol)  |  TTPs/Command and Control/Backdoor:EC2-DenialOfService.UnusualProtocol  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#backdoor-ec2-spambot](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#backdoor-ec2-spambot)  |  TTPs/Command and Control/Backdoor:EC2-Spambot  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#behavior-ec2-networkportunusual](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#behavior-ec2-networkportunusual)  |  Unusual Behaviors/VM/Behavior:EC2-NetworkPortUnusual  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#behavior-ec2-trafficvolumeunusual](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#behavior-ec2-trafficvolumeunusual)  |  Unusual Behaviors/VM/Behavior:EC2-TrafficVolumeUnusual  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/lambda-protection-finding-types.html#backdoor-lambda-ccactivity-b](https://docs.aws.amazon.com/guardduty/latest/ug/lambda-protection-finding-types.html#backdoor-lambda-ccactivity-b)  |  TTPs/Command and Control/Backdoor:Lambda-C&CActivity.B  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#backdoor-runtime-ccactivityb](https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#backdoor-runtime-ccactivityb)  |  TTPs/Command and Control/Backdoor:Runtime-C&CActivity.B  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#backdoor-runtime-ccactivitybdns](https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#backdoor-runtime-ccactivitybdns)  |  TTPs/Command and Control/Backdoor:Runtime-C&CActivity.B\$1DNS  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#credentialaccess-iam-anomalousbehavior](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#credentialaccess-iam-anomalousbehavior)  |  TTPs/Credential Access/IAMUser-AnomalousBehavior  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#credaccess-kubernetes-anomalousbehavior-secretsaccessed](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#credaccess-kubernetes-anomalousbehavior-secretsaccessed)  |  TTPs/AnomalousBehavior/CredentialAccess:Kubernetes-SecretsAccessed  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#credentialaccess-kubernetes-maliciousipcaller](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#credentialaccess-kubernetes-maliciousipcaller)  |  TTPs/CredentialAccess/CredentialAccess:Kubernetes-MaliciousIPCaller  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#credentialaccess-kubernetes-maliciousipcallercustom](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#credentialaccess-kubernetes-maliciousipcallercustom)  |  TTPs/CredentialAccess/CredentialAccess:Kubernetes-MaliciousIPCaller.Custom  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#credentialaccess-kubernetes-successfulanonymousaccess](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#credentialaccess-kubernetes-successfulanonymousaccess)  |  TTPs/CredentialAccess/CredentialAccess:Kubernetes-SuccessfulAnonymousAccess  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#credentialaccess-kubernetes-toripcaller](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#credentialaccess-kubernetes-toripcaller)  |  TTPs/CredentialAccess/CredentialAccess:Kubernetes-TorIPCaller  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-rds-protection.html#credaccess-rds-anombehavior-failedlogin](https://docs.aws.amazon.com/guardduty/latest/ug/findings-rds-protection.html#credaccess-rds-anombehavior-failedlogin)  |  TTPs/Credential Access/CredentialAccess:RDS-AnomalousBehavior.FailedLogin  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-rds-protection.html#credaccess-rds-anombehavior-successfulbruteforce](https://docs.aws.amazon.com/guardduty/latest/ug/findings-rds-protection.html#credaccess-rds-anombehavior-successfulbruteforce)  |  TTPs/Credential Access/CredentialAccess:RDS-AnomalousBehavior.SuccessfulBruteForce  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-rds-protection.html#credaccess-rds-anombehavior-successlogin](https://docs.aws.amazon.com/guardduty/latest/ug/findings-rds-protection.html#credaccess-rds-anombehavior-successlogin)  |  TTPs/Credential Access/CredentialAccess:RDS-AnomalousBehavior.SuccessfulLogin  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-rds-protection.html#credaccess-rds-maliciousipcaller-failedlogin](https://docs.aws.amazon.com/guardduty/latest/ug/findings-rds-protection.html#credaccess-rds-maliciousipcaller-failedlogin)  |  TTPs/Credential Access/CredentialAccess:RDS-MaliciousIPCaller.FailedLogin  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-rds-protection.html#credaccess-rds-maliciousipcaller-successfullogin](https://docs.aws.amazon.com/guardduty/latest/ug/findings-rds-protection.html#credaccess-rds-maliciousipcaller-successfullogin)  |  TTPs/Credential Access/CredentialAccess:RDS-MaliciousIPCaller.SuccessfulLogin  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-rds-protection.html#credaccess-rds-toripcaller-failedlogin](https://docs.aws.amazon.com/guardduty/latest/ug/findings-rds-protection.html#credaccess-rds-toripcaller-failedlogin)  |  TTPs/Credential Access/CredentialAccess:RDS-TorIPCaller.FailedLogin  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-rds-protection.html#credaccess-rds-toripcaller-successfullogin](https://docs.aws.amazon.com/guardduty/latest/ug/findings-rds-protection.html#credaccess-rds-toripcaller-successfullogin)  |  TTPs/Credential Access/CredentialAccess:RDS-TorIPCaller.SuccessfulLogin  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#cryptocurrency-ec2-bitcointoolb](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#cryptocurrency-ec2-bitcointoolb)  |  TTPs/Command and Control/CryptoCurrency:EC2-BitcoinTool.B  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#cryptocurrency-ec2-bitcointoolbdns](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#cryptocurrency-ec2-bitcointoolbdns)  |  TTPs/Command and Control/CryptoCurrency:EC2-BitcoinTool.B\$1DNS  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/lambda-protection-finding-types.html#cryptocurrency-lambda-bitcointool-b](https://docs.aws.amazon.com/guardduty/latest/ug/lambda-protection-finding-types.html#cryptocurrency-lambda-bitcointool-b)  |  TTPs/Command and Control/CryptoCurrency:Lambda-BitcoinTool.B Effects/Resource Consumption/CryptoCurrency:Lambda-BitcoinTool.B  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#cryptocurrency-runtime-bitcointoolb](https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#cryptocurrency-runtime-bitcointoolb)  |  TTPs/Command and Control/CryptoCurrency:Runtime-BitcoinTool.B  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#cryptocurrency-runtime-bitcointoolbdns](https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#cryptocurrency-runtime-bitcointoolbdns)  |  TTPs/Command and Control/CryptoCurrency:Runtime-BitcoinTool.B\$1DNS  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#defenseevasion-ec2-unusualdnsresolver](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#defenseevasion-ec2-unusualdnsresolver)  |  TTPs/DefenseEvasion/EC2:Unusual-DNS-Resolver  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#defenseevasion-ec2-unsualdohactivity](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#defenseevasion-ec2-unsualdohactivity)  |  TTPs/DefenseEvasion/EC2:Unusual-DoH-Activity  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#defenseevasion-ec2-unusualdotactivity](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#defenseevasion-ec2-unusualdotactivity)  |  TTPs/DefenseEvasion/EC2:Unusual-DoT-Activity  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#defenseevasion-iam-anomalousbehavior](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#defenseevasion-iam-anomalousbehavior)  |  TTPs/Defense Evasion/IAMUser-AnomalousBehavior  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#defenseevasion-iam-bedrockloggingdisabled](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#defenseevasion-iam-bedrockloggingdisabled)  |  TTPs/Defense Evasion/DefenseEvasion:IAMUser-BedrockLoggingDisabled  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#defenseevasion-kubernetes-maliciousipcaller](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#defenseevasion-kubernetes-maliciousipcaller)  |  TTPs/DefenseEvasion/DefenseEvasion:Kubernetes-MaliciousIPCaller  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#defenseevasion-kubernetes-maliciousipcallercustom](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#defenseevasion-kubernetes-maliciousipcallercustom)  |  TTPs/DefenseEvasion/DefenseEvasion:Kubernetes-MaliciousIPCaller.Custom  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#defenseevasion-kubernetes-successfulanonymousaccess](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#defenseevasion-kubernetes-successfulanonymousaccess)  |  TTPs/DefenseEvasion/DefenseEvasion:Kubernetes-SuccessfulAnonymousAccess  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#defenseevasion-kubernetes-toripcaller](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#defenseevasion-kubernetes-toripcaller)  |  TTPs/DefenseEvasion/DefenseEvasion:Kubernetes-TorIPCaller  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#defenseeva-runtime-filelessexecution](https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#defenseeva-runtime-filelessexecution)  |  TTPs/Defense Evasion/DefenseEvasion:Runtime-FilelessExecution  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#defenseevasion-runtime-kernelmoduleloaded](https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#defenseevasion-runtime-kernelmoduleloaded)  |  TTPs/Defense Evasion/DefenseEvasion:Runtime-KernelModuleLoaded  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#defenseeva-runtime-processinjectionproc](https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#defenseeva-runtime-processinjectionproc)  |  TTPs/Defense Evasion/DefenseEvasion:Runtime-ProcessInjection.Proc  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#defenseeva-runtime-processinjectionptrace](https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#defenseeva-runtime-processinjectionptrace)  |  TTPs/Defense Evasion/DefenseEvasion:Runtime-ProcessInjection.Ptrace  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#defenseeva-runtime-processinjectionvirtualmemw](https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#defenseeva-runtime-processinjectionvirtualmemw)  |  TTPs/Defense Evasion/DefenseEvasion:Runtime-ProcessInjection.VirtualMemoryWrite  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#defenseevasion-runtime-ptrace-anti-debug](https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#defenseevasion-runtime-ptrace-anti-debug)  |  TTPs/DefenseEvasion/DefenseEvasion:Runtime-PtraceAntiDebugging  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#defenseevasion-runtime-suspicious-command](https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#defenseevasion-runtime-suspicious-command)  |  TTPs/DefenseEvasion/DefenseEvasion:Runtime-SuspiciousCommand  | 
|  [Découverte :IAMUser/AnomalousBehavior](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#discovery-iam-anomalousbehavior)  |  TTPs/Discovery/IAMUser-AnomalousBehavior  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#discovery-kubernetes-anomalousbehavrior-permissionchecked](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#discovery-kubernetes-anomalousbehavrior-permissionchecked)  |  TTPs/AnomalousBehavior/Discovery:Kubernetes-PermissionChecked  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#discovery-kubernetes-maliciousipcaller](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#discovery-kubernetes-maliciousipcaller)  |  TTPs/Discovery/Discovery:Kubernetes-MaliciousIPCaller  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#discovery-kubernetes-maliciousipcallercustom](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#discovery-kubernetes-maliciousipcallercustom)  |  TTPs/Discovery/Discovery:Kubernetes-MaliciousIPCaller.Custom  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#discovery-kubernetes-successfulanonymousaccess](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#discovery-kubernetes-successfulanonymousaccess)  |  TTPs/Discovery/Discovery:Kubernetes-SuccessfulAnonymousAccess  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#discovery-kubernetes-toripcaller](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#discovery-kubernetes-toripcaller)  |  TTPs/Discovery/Discovery:Kubernetes-TorIPCaller  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-rds-protection.html#discovery-rds-maliciousipcaller](https://docs.aws.amazon.com/guardduty/latest/ug/findings-rds-protection.html#discovery-rds-maliciousipcaller)  |  TTPs/Discovery/RDS-MaliciousIPCaller  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-rds-protection.html#discovery-rds-toripcaller](https://docs.aws.amazon.com/guardduty/latest/ug/findings-rds-protection.html#discovery-rds-toripcaller)  |  TTPs/Discovery/RDS-TorIPCaller  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#discovery-runtime-suspicious-command](https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#discovery-runtime-suspicious-command)  |  TTPs/Discovery/Discovery:Runtime-SuspiciousCommand  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#discovery-s3-anomalousbehavior](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#discovery-s3-anomalousbehavior)  |  TTPs/Discovery:S3-AnomalousBehavior  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#discovery-s3-bucketenumerationunusual](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#discovery-s3-bucketenumerationunusual)  |  TTPs/Discovery:S3-BucketEnumeration.Unusual  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#discovery-s3-maliciousipcallercustom.title](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#discovery-s3-maliciousipcallercustom.title)  |  TTPs/Discovery:S3-MaliciousIPCaller.Custom  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#discovery-s3-toripcaller](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#discovery-s3-toripcaller)  |  TTPs/Discovery:S3-TorIPCaller  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#discovery-s3-maliciousipcaller](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#discovery-s3-maliciousipcaller)  |  TTPs/Discovery:S3-MaliciousIPCaller  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#exfiltration-iam-anomalousbehavior](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#exfiltration-iam-anomalousbehavior)  |  TTPs/Exfiltration/IAMUser-AnomalousBehavior  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#execution-kubernetes-execinkubesystempod](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#execution-kubernetes-execinkubesystempod)  |  TTPs/Execution/Execution:Kubernetes-ExecInKubeSystemPod  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#execution-kubernetes-anomalousbehvaior-execinprod](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#execution-kubernetes-anomalousbehvaior-execinprod)  |  TTPs/AnomalousBehavior/Execution:Kubernetes-ExecInPod  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#exec-kubernetes-anomalousbehavior-workloaddeployed](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#exec-kubernetes-anomalousbehavior-workloaddeployed)  |  TTPs/AnomalousBehavior/Execution:Kubernetes-WorkloadDeployed  | 
|   [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#impact-ec2-maliciousdomainrequest-custom](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#impact-ec2-maliciousdomainrequest-custom)   |  TTPs/Impact/Impact:EC2-MaliciousDomainRequest.Custom  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#impact-kubernetes-maliciousipcaller](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#impact-kubernetes-maliciousipcaller)  |  TTPs/Impact/Impact:Kubernetes-MaliciousIPCaller  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#impact-kubernetes-maliciousipcallercustom](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#impact-kubernetes-maliciousipcallercustom)  |  TTPs/Impact/Impact:Kubernetes-MaliciousIPCaller.Custom  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#impact-kubernetes-successfulanonymousaccess](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#impact-kubernetes-successfulanonymousaccess)  |  TTPs/Impact/Impact:Kubernetes-SuccessfulAnonymousAccess  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#impact-kubernetes-toripcaller](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#impact-kubernetes-toripcaller)  |  TTPs/Impact/Impact:Kubernetes-TorIPCaller  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#persistence-kubernetes-containerwithsensitivemount](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#persistence-kubernetes-containerwithsensitivemount)  | TTPs/Persistence/Persistence:Kubernetes-ContainerWithSensitiveMount | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#privesc-kubernetes-anomalousbehavior-workloaddeployed-containerwithsensitivemount](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#privesc-kubernetes-anomalousbehavior-workloaddeployed-containerwithsensitivemount)  | TTPs/AnomalousBehavior/Persistence:Kubernetes-WorkloadDeployed\$1ContainerWithSensitiveMount | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#privesc-kubernetes-anomalousbehavior-workloaddeployed-privcontainer](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#privesc-kubernetes-anomalousbehavior-workloaddeployed-privcontainer)  |  TTPs/AnomalousBehavior/PrivilegeEscalation:Kubernetes-WorkloadDeployed\$1PrivilegedContainer  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#persistence-kubernetes-maliciousipcaller](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#persistence-kubernetes-maliciousipcaller)  |  TTPs/Persistence/Persistence:Kubernetes-MaliciousIPCaller  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#persistence-kubernetes-maliciousipcallercustom](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#persistence-kubernetes-maliciousipcallercustom)  |  TTPs/Persistence/Persistence:Kubernetes-MaliciousIPCaller.Custom  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#persistence-kubernetes-successfulanonymousaccess](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#persistence-kubernetes-successfulanonymousaccess)  |  TTPs/Persistence/Persistence:Kubernetes-SuccessfulAnonymousAccess  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#persistence-kubernetes-toripcaller](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#persistence-kubernetes-toripcaller)  |  TTPs/Persistence/Persistence:Kubernetes-TorIPCaller  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-malware-protection.html#execution-malware-ec2-maliciousfile](https://docs.aws.amazon.com/guardduty/latest/ug/findings-malware-protection.html#execution-malware-ec2-maliciousfile)  |  TTPs/Execution/Execution:EC2-MaliciousFile  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-malware-protection.html#execution-malware-ecs-maliciousfile](https://docs.aws.amazon.com/guardduty/latest/ug/findings-malware-protection.html#execution-malware-ecs-maliciousfile)  |  TTPs/Execution/Execution:ECS-MaliciousFile  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-malware-protection.html#execution-malware-kubernetes-maliciousfile](https://docs.aws.amazon.com/guardduty/latest/ug/findings-malware-protection.html#execution-malware-kubernetes-maliciousfile)  |  TTPs/Execution/Execution:Kubernetes-MaliciousFile  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-malware-protection.html#execution-malware-container-maliciousfile](https://docs.aws.amazon.com/guardduty/latest/ug/findings-malware-protection.html#execution-malware-container-maliciousfile)  |  TTPs/Execution/Execution:Container-MaliciousFile  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-malware-protection.html#execution-malware-ec2-suspiciousfile](https://docs.aws.amazon.com/guardduty/latest/ug/findings-malware-protection.html#execution-malware-ec2-suspiciousfile)  |  TTPs/Execution/Execution:EC2-SuspiciousFile  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-malware-protection.html#execution-malware-ecs-suspiciousfile](https://docs.aws.amazon.com/guardduty/latest/ug/findings-malware-protection.html#execution-malware-ecs-suspiciousfile)  |  TTPs/Execution/Execution:ECS-SuspiciousFile  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-malware-protection.html#execution-malware-kubernetes-suspiciousfile](https://docs.aws.amazon.com/guardduty/latest/ug/findings-malware-protection.html#execution-malware-kubernetes-suspiciousfile)  |  TTPs/Execution/Execution:Kubernetes-SuspiciousFile  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-malware-protection.html#execution-malware-container-suspiciousfile](https://docs.aws.amazon.com/guardduty/latest/ug/findings-malware-protection.html#execution-malware-container-suspiciousfile)  |  TTPs/Execution/Execution:Container-SuspiciousFile  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-malware-protection-backup.html#execution-malware-ec2-maliciousfile-snapshot](https://docs.aws.amazon.com/guardduty/latest/ug/findings-malware-protection-backup.html#execution-malware-ec2-maliciousfile-snapshot)  |  TTPs/Execution/Execution:EC2-MaliciousFile\$1Snapshot  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-malware-protection-backup.html#execution-malware-ec2-maliciousfile-ami](https://docs.aws.amazon.com/guardduty/latest/ug/findings-malware-protection-backup.html#execution-malware-ec2-maliciousfile-ami)  |  TTPs/Execution/Execution:EC2-MaliciousFile\$1AMI  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-malware-protection-backup.html#execution-malware-ec2-maliciousfile-recoverypoint](https://docs.aws.amazon.com/guardduty/latest/ug/findings-malware-protection-backup.html#execution-malware-ec2-maliciousfile-recoverypoint)  |  TTPs/Execution/Execution:EC2-MaliciousFile\$1RecoveryPoint  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-malware-protection-backup.html#execution-malware-s3-maliciousfile-recoverypoint](https://docs.aws.amazon.com/guardduty/latest/ug/findings-malware-protection-backup.html#execution-malware-s3-maliciousfile-recoverypoint)  |  TTPs/Execution/Execution:S3-MaliciousFile\$1RecoveryPoint  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-malware-protection.html#execution-runtime-malicious-file-executed](https://docs.aws.amazon.com/guardduty/latest/ug/findings-malware-protection.html#execution-runtime-malicious-file-executed)  |  TTPs/Execution/Execution:Runtime-MaliciousFileExecuted  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#execution-runtime-newbinaryexecuted](https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#execution-runtime-newbinaryexecuted)  |  TTPs/Execution/Execution:Runtime-NewBinaryExecuted  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#execution-runtime-newlibraryloaded](https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#execution-runtime-newlibraryloaded)  |  TTPs/Execution/Execution:Runtime-NewLibraryLoaded  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#execution-runtime-reverseshell](https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#execution-runtime-reverseshell)  |  TTPs/Execution/Execution:Runtime-ReverseShell  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#execution-runtime-suspiciouscommand](https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#execution-runtime-suspiciouscommand)  |  TTPs/Execution/Execution:Runtime-SuspiciousCommand  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#execution-runtime-suspicious-shell-created](https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#execution-runtime-suspicious-shell-created)  |  TTPs/Execution/Execution:Runtime-SuspiciousShellCreated  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#execution-runtime-suspicioustool](https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#execution-runtime-suspicioustool)  |  TTPs/Execution/Execution:Runtime-SuspiciousTool  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#exfiltration-s3-anomalousbehavior](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#exfiltration-s3-anomalousbehavior)  |  TTPs/Exfiltration:S3-AnomalousBehavior  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#exfiltration-s3-objectreadunusual](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#exfiltration-s3-objectreadunusual)  |  TTPs/Exfiltration:S3-ObjectRead.Unusual  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#exfiltration-s3-maliciousipcaller](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#exfiltration-s3-maliciousipcaller)  |  TTPs/Exfiltration:S3-MaliciousIPCaller  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#impact-ec2-abuseddomainrequestreputation](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#impact-ec2-abuseddomainrequestreputation)  |  TTPs/Impact:EC2-AbusedDomainRequest.Reputation  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#impact-ec2-bitcoindomainrequestreputation](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#impact-ec2-bitcoindomainrequestreputation)  |  TTPs/Impact:EC2-BitcoinDomainRequest.Reputation  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#impact-ec2-maliciousdomainrequestreputation](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#impact-ec2-maliciousdomainrequestreputation)  |  TTPs/Impact:EC2-MaliciousDomainRequest.Reputation  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#impact-ec2-portsweep](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#impact-ec2-portsweep)  |  TTPs/Impact/Impact:EC2-PortSweep  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#impact-ec2-suspiciousdomainrequestreputation](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#impact-ec2-suspiciousdomainrequestreputation)  |  TTPs/Impact:EC2-SuspiciousDomainRequest.Reputation  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#impact-ec2-winrmbruteforce](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#impact-ec2-winrmbruteforce)  |  TTPs/Impact/Impact:EC2-WinRMBruteForce  | 
|  [Répercussions :IAMUser/AnomalousBehavior](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#impact-iam-anomalousbehavior)  |  TTPs/Impact/IAMUser-AnomalousBehavior  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#impact-runtime-abuseddomainrequestreputation](https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#impact-runtime-abuseddomainrequestreputation)  |  TTPs/Impact/Impact:Runtime-AbusedDomainRequest.Reputation  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#impact-runtime-bitcoindomainrequestreputation](https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#impact-runtime-bitcoindomainrequestreputation)  |  TTPs/Impact/Impact:Runtime-BitcoinDomainRequest.Reputation  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#impact-runtime-cryptominerexecuted](https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#impact-runtime-cryptominerexecuted)  |  TTPs/Impact/Impact:Runtime-CryptoMinerExecuted  | 
| [https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#impact-runtime-maliciousdomainrequestreputation](https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#impact-runtime-maliciousdomainrequestreputation)  |  TTPs/Impact/Impact:Runtime-MaliciousDomainRequest.Reputation  | 
| [https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#impact-runtime-suspiciousdomainrequestreputation](https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#impact-runtime-suspiciousdomainrequestreputation)  |  TTPs/Impact/Impact:Runtime-SuspiciousDomainRequest.Reputatio  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#impact-s3-anomalousbehavior-delete](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#impact-s3-anomalousbehavior-delete)  |  TTPs/Impact:S3-AnomalousBehavior.Delete  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#impact-s3-anomalousbehavior-permission](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#impact-s3-anomalousbehavior-permission)  |  TTPs/Impact:S3-AnomalousBehavior.Permission  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#impact-s3-anomalousbehavior-write](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#impact-s3-anomalousbehavior-write)  |  TTPs/Impact:S3-AnomalousBehavior.Write  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#impact-s3-objectdeleteunusual](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#impact-s3-objectdeleteunusual)  |  TTPs/Impact:S3-ObjectDelete.Unusual  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#impact-s3-permissionsmodificationunusual](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#impact-s3-permissionsmodificationunusual)  |  TTPs/Impact:S3-PermissionsModification.Unusual  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#impact-s3-maliciousipcaller](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#impact-s3-maliciousipcaller)  |  TTPs/Impact:S3-MaliciousIPCaller  | 
|  [InitialAccess:IAMUser/AnomalousBehavior](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#initialaccess-iam-anomalousbehavior)  |  TTPs/Initial Access/IAMUser-AnomalousBehavior  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/gdu-malware-protection-s3-finding-types.html#s3-object-s3-malicious-file](https://docs.aws.amazon.com/guardduty/latest/ug/gdu-malware-protection-s3-finding-types.html#s3-object-s3-malicious-file)  |  TTPs/Object/Object:S3-MaliciousFile  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#pentest-iam-kalilinux](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#pentest-iam-kalilinux)  |  TTPs/PenTest:IAMUser/KaliLinux  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#pentest-iam-parrotlinux](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#pentest-iam-parrotlinux)  |  TTPs/PenTest:IAMUser/ParrotLinux  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#pentest-iam-pentoolinux](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#pentest-iam-pentoolinux)  |  TTPs/PenTest:IAMUser/PentooLinux  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#pentest-iam-kalilinux](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#pentest-iam-kalilinux)  |  TTPs/PenTest:S3-KaliLinux  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#pentest-s3-parrotlinux](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#pentest-s3-parrotlinux)  |  TTPs/PenTest:S3-ParrotLinux  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#pentest-s3-pentoolinux](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#pentest-s3-pentoolinux)  |  TTPs/PenTest:S3-PentooLinux  | 
|   [Persistance :IAMUser/AnomalousBehavior](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#persistence-iam-anomalousbehavior)   | TTPs/Persistence/IAMUser-AnomalousBehavior | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#persistence-iam-networkpermissions](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#persistence-iam-networkpermissions)  |  TTPs/Persistence/Persistence:IAMUser-NetworkPermissions  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#persistence-iam-resourcepermissions](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#persistence-iam-resourcepermissions)  |  TTPs/Persistence/Persistence:IAMUser-ResourcePermissions  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#persistence-iam-userpermissions](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#persistence-iam-userpermissions)  |  TTPs/Persistence/Persistence:IAMUser-UserPermissions  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#persistence-runtime-suspicious-command](https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#persistence-runtime-suspicious-command)  |  TTPs/Persistence/Persistence:Runtime-SuspiciousCommand  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#policy-iam-rootcredentialusage](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#policy-iam-rootcredentialusage)  |  TTPs/Policy:IAMUser-RootCredentialUsage  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#policy-iam-user-short-term-root-credential-usage](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#policy-iam-user-short-term-root-credential-usage)  |  TTPs/Policy:IAMUser-ShortTermRootCredentialUsage  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#policy-kubernetes-adminaccesstodefaultserviceaccount](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#policy-kubernetes-adminaccesstodefaultserviceaccount)  |  Software and Configuration Checks/AWS Security Best Practices/Policy:Kubernetes-AdminAccessToDefaultServiceAccount  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#policy-kubernetes-anonymousaccessgranted](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#policy-kubernetes-anonymousaccessgranted)  |  Software and Configuration Checks/AWS Security Best Practices/Policy:Kubernetes-AnonymousAccessGranted  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#policy-kubernetes-exposeddashboard](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#policy-kubernetes-exposeddashboard)  |  Software and Configuration Checks/AWS Security Best Practices/Policy:Kubernetes-ExposedDashboard  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#policy-kubernetes-kubeflowdashboardexposed](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#policy-kubernetes-kubeflowdashboardexposed)  |  Software and Configuration Checks/AWS Security Best Practices/Policy:Kubernetes-KubeflowDashboardExposed  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#policy-s3-accountblockpublicaccessdisabled](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#policy-s3-accountblockpublicaccessdisabled)  |  TTPs/Policy:S3-AccountBlockPublicAccessDisabled  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#policy-s3-bucketanonymousaccessgranted](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#policy-s3-bucketanonymousaccessgranted)  |  TTPs/Policy:S3-BucketAnonymousAccessGranted  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#policy-s3-bucketblockpublicaccessdisabled](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#policy-s3-bucketblockpublicaccessdisabled)  |  Effects/Data Exposure/Policy:S3-BucketBlockPublicAccessDisabled  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#policy-s3-bucketpublicaccessgranted](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#policy-s3-bucketpublicaccessgranted)  |  TTPs/Policy:S3-BucketPublicAccessGranted  | 
|   [PrivilegeEscalation:IAMUser/AnomalousBehavior](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#privilegeescalation-iam-anomalousbehavior)   |  TTPs/Privilege Escalation/IAMUser-AnomalousBehavior  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#privilegeescalation-iam-administrativepermissions](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#privilegeescalation-iam-administrativepermissions)  |  TTPs/Privilege Escalation/PrivilegeEscalation:IAMUser-AdministrativePermissions  | 
| [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#privesc-kubernetes-anomalousbehavior-rolebindingcreated](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#privesc-kubernetes-anomalousbehavior-rolebindingcreated) |  TTPs/AnomalousBehavior/PrivilegeEscalation:Kubernetes-RoleBindingCreated  | 
| [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#privesc-kubernetes-anomalousbehavior-rolecreated](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#privesc-kubernetes-anomalousbehavior-rolecreated) |  TTPs/AnomalousBehavior/PrivilegeEscalation:Kubernetes-RoleCreated  | 
| [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#privilegeescalation-kubernetes-privilegedcontainer](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-finding-types-eks-audit-logs.html#privilegeescalation-kubernetes-privilegedcontainer) |  TTPs/PrivilegeEscalation/PrivilegeEscalation:Kubernetes-PrivilegedContainer  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#privilegeesc-runtime-containermountshostdirectory](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#privilegeesc-runtime-containermountshostdirectory)  |  TTPs/Privilege Escalation/PrivilegeEscalation:Runtime-ContainerMountsHostDirectory  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#privilegeesc-runtime-cgroupsreleaseagentmodified](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#privilegeesc-runtime-cgroupsreleaseagentmodified)  |  TTPs/Privilege Escalation/PrivilegeEscalation:Runtime-CGroupsReleaseAgentModified  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#privilegeesc-runtime-dockersocketaccessed](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#privilegeesc-runtime-dockersocketaccessed)  |  TTPs/Privilege Escalation/PrivilegeEscalation:Runtime-DockerSocketAccessed  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#privilegeesc-runtime-elevation-to-root](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#privilegeesc-runtime-elevation-to-root)  |  TTPs/Privilege Escalation/PrivilegeEscalation:Runtime-ElevationToRoot  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#privilegeesc-runtime-runccontainerescape](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#privilegeesc-runtime-runccontainerescape)  |  TTPs/Privilege Escalation/PrivilegeEscalation:Runtime-RuncContainerEscape  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#privilege-escalation-runtime-suspicious-command](https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#privilege-escalation-runtime-suspicious-command)  |  Software and Configuration Checks/PrivilegeEscalation:Runtime-SuspiciousCommand  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#privilegeesc-runtime-userfaultfdusage](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#privilegeesc-runtime-userfaultfdusage)  |  TTPs/Privilege Escalation/PrivilegeEscalation:Runtime-UserfaultfdUsage  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#recon-ec2-portprobeemrunprotectedport](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#recon-ec2-portprobeemrunprotectedport)  |  TTPs/Discovery/Recon:EC2-PortProbeEMRUnprotectedPort  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#recon-ec2-portprobeunprotectedport](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#recon-ec2-portprobeunprotectedport)  |  TTPs/Discovery/Recon:EC2-PortProbeUnprotectedPort  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#recon-ec2-portscan](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#recon-ec2-portscan)  |  TTPs/Discovery/Recon:EC2-Portscan  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#recon-iam-maliciousipcaller](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#recon-iam-maliciousipcaller)  |  TTPs/Discovery/Recon:IAMUser-MaliciousIPCaller  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#recon-iam-maliciousipcallercustom](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#recon-iam-maliciousipcallercustom)  |  TTPs/Discovery/Recon:IAMUser-MaliciousIPCaller.Custom  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#recon-iam-networkpermissions](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#recon-iam-networkpermissions)  |  TTPs/Discovery/Recon:IAMUser-NetworkPermissions  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#recon-iam-resourcepermissions](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#recon-iam-resourcepermissions)  |  TTPs/Discovery/Recon:IAMUser-ResourcePermissions  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#recon-iam-toripcaller](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#recon-iam-toripcaller)  |  TTPs/Discovery/Recon:IAMUser-TorIPCaller  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#recon-iam-userpermissions](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#recon-iam-userpermissions)  |  TTPs/Discovery/Recon:IAMUser-UserPermissions  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#resourceconsumption-iam-computeresources](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#resourceconsumption-iam-computeresources)  |  Unusual Behaviors/User/ResourceConsumption:IAMUser-ComputeResources  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#stealth-iam-cloudtrailloggingdisabled](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#stealth-iam-cloudtrailloggingdisabled)  |  TTPs/Defense Evasion/Stealth:IAMUser-CloudTrailLoggingDisabled  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#stealth-iam-loggingconfigurationmodified](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#stealth-iam-loggingconfigurationmodified)  |  TTPs/Defense Evasion/Stealth:IAMUser-LoggingConfigurationModified  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#stealth-iam-passwordpolicychange](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#stealth-iam-passwordpolicychange)  |  TTPs/Defense Evasion/Stealth:IAMUser-PasswordPolicyChange  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#stealth-s3-serveraccessloggingdisabled](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#stealth-s3-serveraccessloggingdisabled)  |  TTPs/Defense Evasion/Stealth:S3-ServerAccessLoggingDisabled  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#trojan-ec2-blackholetraffic](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#trojan-ec2-blackholetraffic)  |  TTPs/Command and Control/Trojan:EC2-BlackholeTraffic  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#trojan-ec2-blackholetrafficdns](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#trojan-ec2-blackholetrafficdns)  |  TTPs/Command and Control/Trojan:EC2-BlackholeTraffic\$1DNS  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#trojan-ec2-dgadomainrequestb](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#trojan-ec2-dgadomainrequestb)  |  TTPs/Command and Control/Trojan:EC2-DGADomainRequest.B  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#trojan-ec2-dgadomainrequestcdns](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#trojan-ec2-dgadomainrequestcdns)  |  TTPs/Command and Control/Trojan:EC2-DGADomainRequest.C\$1DNS  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#trojan-ec2-dnsdataexfiltration](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#trojan-ec2-dnsdataexfiltration)  |  TTPs/Command and Control/Trojan:EC2-DNSDataExfiltration  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#trojan-ec2-drivebysourcetrafficdns](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#trojan-ec2-drivebysourcetrafficdns)  |  TTPs/Initial Access/Trojan:EC2-DriveBySourceTraffic\$1DNS  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#trojan-ec2-droppoint](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#trojan-ec2-droppoint)  |  Effects/Data Exfiltration/Trojan:EC2-DropPoint  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#trojan-ec2-droppointdns](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#trojan-ec2-droppointdns)  |  Effects/Data Exfiltration/Trojan:EC2-DropPoint\$1DNS  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#trojan-ec2-phishingdomainrequestdns](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#trojan-ec2-phishingdomainrequestdns)  |  TTPs/Command and Control/Trojan:EC2-PhishingDomainRequest\$1DNS  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/lambda-protection-finding-types.html#trojan-lambda-blackhole-traffic](https://docs.aws.amazon.com/guardduty/latest/ug/lambda-protection-finding-types.html#trojan-lambda-blackhole-traffic)  |  TTPs/Command and Control/Trojan:Lambda-BlackholeTraffic  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/lambda-protection-finding-types.html#trojan-lambda-drop-point](https://docs.aws.amazon.com/guardduty/latest/ug/lambda-protection-finding-types.html#trojan-lambda-drop-point)  |  Effects/Data Exfiltration/Trojan:Lambda-DropPoint  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#trojan-runtime-blackholetraffic](https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#trojan-runtime-blackholetraffic)  |  TTPs/Command and Control/Trojan:Runtime-BlackholeTraffic  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#trojan-runtime-blackholetrafficdns](https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#trojan-runtime-blackholetrafficdns)  |  TTPs/Command and Control/Trojan:Runtime-BlackholeTraffic\$1DNS  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#trojan-runtime-dgadomainrequestcdns](https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#trojan-runtime-dgadomainrequestcdns)  |  TTPs/Command and Control/Trojan:Runtime-DGADomainRequest.C\$1DNS  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#trojan-runtime-drivebysourcetrafficdns](https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#trojan-runtime-drivebysourcetrafficdns)  |  TTPs/Initial Access/Trojan:Runtime-DriveBySourceTraffic\$1DNS  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#trojan-runtime-droppoint](https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#trojan-runtime-droppoint)  |  Effects/Data Exfiltration/Trojan:Runtime-DropPoint  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#trojan-runtime-droppointdns](https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#trojan-runtime-droppointdns)  |  Effects/Data Exfiltration/Trojan:Runtime-DropPoint\$1DNS  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#trojan-runtime-phishingdomainrequestdns](https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#trojan-runtime-phishingdomainrequestdns)  |  TTPs/Command and Control/Trojan:Runtime-PhishingDomainRequest\$1DNS  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#unauthorizedaccess-ec2-maliciousipcallercustom](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#unauthorizedaccess-ec2-maliciousipcallercustom)  |  TTPs/Command and Control/UnauthorizedAccess:EC2-MaliciousIPCaller.Custom  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#unauthorizedaccess-ec2-metadatadnsrebind](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#unauthorizedaccess-ec2-metadatadnsrebind)  |  TTPs/UnauthorizedAccess:EC2-MetadataDNSRebind  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#unauthorizedaccess-ec2-rdpbruteforce](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#unauthorizedaccess-ec2-rdpbruteforce)  |  TTPs/Initial Access/UnauthorizedAccess:EC2-RDPBruteForce  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#unauthorizedaccess-ec2-sshbruteforce](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#unauthorizedaccess-ec2-sshbruteforce)  |  TTPs/Initial Access/UnauthorizedAccess:EC2-SSHBruteForce  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#unauthorizedaccess-ec2-torclient](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#unauthorizedaccess-ec2-torclient)  |  Effects/Resource Consumption/UnauthorizedAccess:EC2-TorClient  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#unauthorizedaccess-ec2-torrelay](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#unauthorizedaccess-ec2-torrelay)  |  Effects/Resource Consumption/UnauthorizedAccess:EC2-TorRelay  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#unauthorizedaccess-iam-consolelogin](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-retired.html#unauthorizedaccess-iam-consolelogin)  |  Unusual Behaviors/User/UnauthorizedAccess:IAMUser-ConsoleLogin  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#unauthorizedaccess-iam-consoleloginsuccessb](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#unauthorizedaccess-iam-consoleloginsuccessb)  |  TTPs/UnauthorizedAccess:IAMUser-ConsoleLoginSuccess.B  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#unauthorizedaccess-iam-instancecredentialexfiltrationinsideaws](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#unauthorizedaccess-iam-instancecredentialexfiltrationinsideaws)  |  Effects/Data Exfiltration/UnauthorizedAccess:IAMUser-InstanceCredentialExfiltration.InsideAWS  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#unauthorizedaccess-iam-instancecredentialexfiltrationoutsideaws](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#unauthorizedaccess-iam-instancecredentialexfiltrationoutsideaws)  |  Effects/Data Exfiltration/UnauthorizedAccess:IAMUser-InstanceCredentialExfiltration.OutsideAWS  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#unauthorizedaccess-iam-maliciousipcaller](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#unauthorizedaccess-iam-maliciousipcaller)  |  TTPs/UnauthorizedAccess:IAMUser-MaliciousIPCaller  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#unauthorizedaccess-iam-maliciousipcallercustom](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#unauthorizedaccess-iam-maliciousipcallercustom)  |  TTPs/UnauthorizedAccess:IAMUser-MaliciousIPCaller.Custom  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#unauthorizedaccess-iam-resourcecredentialexfiltrationoutsideaws](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#unauthorizedaccess-iam-resourcecredentialexfiltrationoutsideaws)  |  Effects/Data Exfiltration/UnauthorizedAccess:IAMUser-ResourceCredentialExfiltration.OutsideAWS  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#unauthorizedaccess-iam-toripcaller](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#unauthorizedaccess-iam-toripcaller)  |  TTPs/Command and Control/UnauthorizedAccess:IAMUser-TorIPCaller  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/lambda-protection-finding-types.html#unauthorized-access-lambda-maliciousIPcaller-custom](https://docs.aws.amazon.com/guardduty/latest/ug/lambda-protection-finding-types.html#unauthorized-access-lambda-maliciousIPcaller-custom)  |  TTPs/Command and Control/UnauthorizedAccess:Lambda-MaliciousIPCaller.Custom  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/lambda-protection-finding-types.html#unauthorized-access-lambda-tor-client](https://docs.aws.amazon.com/guardduty/latest/ug/lambda-protection-finding-types.html#unauthorized-access-lambda-tor-client)  |  Effects/Resource Consumption/UnauthorizedAccess:Lambda-TorClient  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/lambda-protection-finding-types.html#unauthorized-access-lambda-tor-relay](https://docs.aws.amazon.com/guardduty/latest/ug/lambda-protection-finding-types.html#unauthorized-access-lambda-tor-relay)  |  Effects/Resource Consumption/UnauthorizedAccess:Lambda-TorRelay  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#unauthorizedaccess-runtime-metadatadnsrebind](https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#unauthorizedaccess-runtime-metadatadnsrebind)  |  TTPs/UnauthorizedAccess:Runtime-MetadataDNSRebind  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#unauthorizedaccess-runtime-torrelay](https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#unauthorizedaccess-runtime-torrelay)  |  Effects/Resource Consumption/UnauthorizedAccess:Runtime-TorRelay  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#unauthorizedaccess-runtime-torclient](https://docs.aws.amazon.com/guardduty/latest/ug/findings-runtime-monitoring.html#unauthorizedaccess-runtime-torclient)  |  Effects/Resource Consumption/UnauthorizedAccess:Runtime-TorClient  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#unauthorizedaccess-s3-maliciousipcallercustom](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#unauthorizedaccess-s3-maliciousipcallercustom)  |  TTPs/UnauthorizedAccess:S3-MaliciousIPCaller.Custom  | 
|  [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#unauthorizedaccess-s3-toripcaller](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-s3.html#unauthorizedaccess-s3-toripcaller)  |  TTPs/UnauthorizedAccess:S3-TorIPCaller  | 

### Constatation typique tirée de GuardDuty
<a name="securityhub-integration-finding-example"></a>

GuardDuty envoie les résultats au Security Hub CSPM en utilisant le format [ASFF (AWS Security Finding Format)](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-findings-format.html).

Voici un exemple de résultat typique tiré de GuardDuty.

```
  {
  "SchemaVersion": "2018-10-08",
  "Id": "arn:aws:guardduty:us-east-1:193043430472:detector/d4b040365221be2b54a6264dc9a4bc64/finding/46ba0ac2845071e23ccdeb2ae03bfdea",
  "ProductArn": "arn:aws:securityhub:us-east-1:product/aws/guardduty",
  "GeneratorId": "arn:aws:guardduty:us-east-1:193043430472:detector/d4b040365221be2b54a6264dc9a4bc64",
  "AwsAccountId": "193043430472",
  "Types": [
    "TTPs/Initial Access/UnauthorizedAccess:EC2-SSHBruteForce"
  ],
  "FirstObservedAt": "2020-08-22T09:15:57Z",
  "LastObservedAt": "2020-09-30T11:56:49Z",
  "CreatedAt": "2020-08-22T09:34:34.146Z",
  "UpdatedAt": "2020-09-30T12:14:00.206Z",
  "Severity": {
    "Product": 2,
    "Label": "MEDIUM",
    "Normalized": 40
  },
  "Title": "199.241.229.197 is performing SSH brute force attacks against i-0c10c2c7863d1a356.",
  "Description": "199.241.229.197 is performing SSH brute force attacks against i-0c10c2c7863d1a356. Brute force attacks are used to gain unauthorized access to your instance by guessing the SSH password.",
  "SourceUrl": "https://us-east-1.console.aws.amazon.com/guardduty/home?region=us-east-1#/findings?macros=current&fId=46ba0ac2845071e23ccdeb2ae03bfdea",
  "ProductFields": {
    "aws/guardduty/service/action/networkConnectionAction/remotePortDetails/portName": "Unknown",
    "aws/guardduty/service/archived": "false",
    "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/organization/asnOrg": "CENTURYLINK-US-LEGACY-QWEST",
    "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/geoLocation/lat": "42.5122",
    "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/ipAddressV4": "199.241.229.197",
    "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/geoLocation/lon": "-90.7384",
    "aws/guardduty/service/action/networkConnectionAction/blocked": "false",
    "aws/guardduty/service/action/networkConnectionAction/remotePortDetails/port": "46717",
    "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/country/countryName": "United States",
    "aws/guardduty/service/serviceName": "guardduty",
    "aws/guardduty/service/evidence": "",
    "aws/guardduty/service/action/networkConnectionAction/localIpDetails/ipAddressV4": "172.31.43.6",
    "aws/guardduty/service/detectorId": "d4b040365221be2b54a6264dc9a4bc64",
    "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/organization/org": "CenturyLink",
    "aws/guardduty/service/action/networkConnectionAction/connectionDirection": "INBOUND",
    "aws/guardduty/service/eventFirstSeen": "2020-08-22T09:15:57Z",
    "aws/guardduty/service/eventLastSeen": "2020-09-30T11:56:49Z",
    "aws/guardduty/service/action/networkConnectionAction/localPortDetails/portName": "SSH",
    "aws/guardduty/service/action/actionType": "NETWORK_CONNECTION",
    "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/city/cityName": "Dubuque",
    "aws/guardduty/service/additionalInfo": "",
    "aws/guardduty/service/resourceRole": "TARGET",
    "aws/guardduty/service/action/networkConnectionAction/localPortDetails/port": "22",
    "aws/guardduty/service/action/networkConnectionAction/protocol": "TCP",
    "aws/guardduty/service/count": "74",
    "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/organization/asn": "209",
    "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/organization/isp": "CenturyLink",
    "aws/securityhub/FindingId": "arn:aws:securityhub:us-east-1::product/aws/guardduty/arn:aws:guardduty:us-east-1:193043430472:detector/d4b040365221be2b54a6264dc9a4bc64/finding/46ba0ac2845071e23ccdeb2ae03bfdea",
    "aws/securityhub/ProductName": "GuardDuty",
    "aws/securityhub/CompanyName": "Amazon"
  },
  "Resources": [
    {
      "Type": "AwsEc2Instance",
      "Id": "arn:aws:ec2:us-east-1:193043430472:instance/i-0c10c2c7863d1a356",
      "Partition": "aws",
      "Region": "us-east-1",
      "Tags": {
        "Name": "kubectl"
      },
      "Details": {
        "AwsEc2Instance": {
          "Type": "t2.micro",
          "ImageId": "ami-02354e95b39ca8dec",
          "IpV4Addresses": [
            "18.234.130.16",
            "172.31.43.6"
          ],
          "VpcId": "vpc-a0c2d7c7",
          "SubnetId": "subnet-4975b475",
          "LaunchedAt": "2020-08-03T23:21:57Z"
        }
      }
    }
  ],
  "WorkflowState": "NEW",
  "Workflow": {
    "Status": "NEW"
  },
  "RecordState": "ACTIVE"
}
```

## Activation et configuration de l'intégration
<a name="securityhub-integration-enable"></a>

Pour utiliser l'intégration avec AWS Security Hub CSPM, vous devez activer Security Hub CSPM. Pour plus d'informations sur l'activation de Security Hub CSPM, consultez la section [Configuration de Security Hub](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-settingup.html) dans le guide de l'*AWS Security Hub utilisateur*.

Lorsque vous activez à la fois Security Hub CSPM GuardDuty et Security Hub, l'intégration est automatiquement activée. GuardDutycommence immédiatement à envoyer les résultats à Security Hub CSPM.

## Utilisation GuardDuty des contrôles dans Security Hub CSPM
<a name="securityhub-integration-using-guardduty-controls"></a>

AWS Security Hub CSPM utilise des contrôles de sécurité pour évaluer vos AWS ressources et vérifier votre conformité par rapport aux normes et aux meilleures pratiques du secteur de la sécurité. Vous pouvez utiliser les contrôles relatifs aux GuardDuty ressources et aux plans de protection sélectionnés. Pour plus d'informations, consultez [Amazon GuardDuty Controls](https://docs.aws.amazon.com/securityhub/latest/userguide/guardduty-controls.html) dans le *guide de AWS Security Hub l'utilisateur*.

Pour obtenir la liste de tous les contrôles relatifs AWS aux services et aux ressources, consultez [la référence aux contrôles Security Hub CSPM](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-controls-reference.html) dans le guide de l'*AWS Security Hub utilisateur*.

## Arrêt de la publication des résultats sur Security Hub CSPM
<a name="securityhub-integration-disable"></a>

Pour arrêter l’envoi des résultats à Security Hub CSPM, vous pouvez utiliser la console Security Hub CSPM ou l’API.

Consultez la section [Désactivation et activation du flux de résultats d'une intégration (console)](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-integrations-managing.html#securityhub-integration-findings-flow-console) ou [Désactivation du flux de résultats d'une intégration (API Security Hub, AWS CLI)](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-integrations-managing.html#securityhub-integration-findings-flow-disable-api) dans le guide de l'*AWS Security Hub utilisateur*.

# Intégration à Amazon Detective
<a name="detective-integration"></a>

[Amazon Detective](https://docs.aws.amazon.com/detective/latest/userguide/what-is-detective.html) vous aide à analyser et à enquêter rapidement sur les événements de sécurité liés à un ou plusieurs AWS comptes en générant des visualisations de données représentant le comportement et l'interaction de vos ressources au fil du temps. Detective crée des visualisations des GuardDuty résultats.

Detective ingère les détails des résultats pour tous les types de résultat et donne accès aux profils des entités afin d'enquêter sur les différentes entités impliquées dans le résultat. Une entité peut être une Compte AWS, une AWS ressource au sein d'un compte ou une adresse IP externe qui a interagi avec vos ressources. La GuardDuty console permet de basculer vers Amazon Detective à partir des entités suivantes, en fonction du type de recherche : Compte AWS rôle IAM, utilisateur ou session de rôle, agent utilisateur, utilisateur fédéré, instance Amazon EC2 ou adresse IP. 

**Contents**
+ [Activation de l'intégration](#detective-integration-enable)
+ [Passer à Amazon Detective à partir d'une découverte GuardDuty](#pivot-to-detective)
+ [Utilisation de l'intégration avec un environnement GuardDuty multi-comptes](#detective-integration-multiaccount)

## Activation de l'intégration
<a name="detective-integration-enable"></a>

Pour utiliser Amazon Detective avec, GuardDuty vous devez d'abord activer Amazon Detective. Pour plus d'informations sur l'activation de Detective, consultez [Getting started with Amazon Detective](https://docs.aws.amazon.com/detective/latest/userguide/detective-setup.html) dans le *guide de l'utilisateur Amazon Detective*.

Lorsque vous activez à la fois Detective GuardDuty et Detective, l'intégration est automatiquement activée. Une fois activé, Detective ingère immédiatement les données de vos GuardDuty découvertes.

**Note**  
GuardDuty envoie les résultats à Detective en fonction de la fréquence d'exportation des GuardDuty résultats. Par défaut, la fréquence d'exportation pour les mises à jour des résultats existants est de 6 heures. Pour que Detective reçoive les dernières mises à jour de vos résultats, il est recommandé de modifier la fréquence d'exportation à 15 minutes dans chaque région avec laquelle vous utilisez Detective GuardDuty. Pour de plus amples informations, veuillez consulter [Étape 5 — Définition de la fréquence d'exportation des résultats actifs mis à jour](guardduty_exportfindings.md#guardduty_exportfindings-frequency).

## Passer à Amazon Detective à partir d'une découverte GuardDuty
<a name="pivot-to-detective"></a>

1. Connectez-vous à la [https://console.aws.amazon.com/guardduty/](https://console.aws.amazon.com/guardduty/)console.

1. Choisissez un seul résultat dans votre tableau des résultats.

1. Choisissez **Enquêter avec Detective** dans le volet des informations du résultat.

1. Choisissez un aspect du résultat à examiner avec Amazon Detective. Cela permet d'ouvrir la console Detective pour ce résultat ou cette entité.

Si le basculement ne se comporte pas comme prévu, veuillez consulter [Résolution des problèmes liés au pivot](https://docs.aws.amazon.com/detective/latest/userguide/profile-pivot-from-service.html#profile-pivot-troubleshooting) dans le *Guide de l'utilisateur Amazon Detective*.

**Note**  
Si vous archivez une GuardDuty découverte dans la console Detective, elle est également archivée dans la GuardDuty console.

## Utilisation de l'intégration avec un environnement GuardDuty multi-comptes
<a name="detective-integration-multiaccount"></a>

Si vous gérez un environnement multi-comptes dans GuardDuty, vous devez ajouter vos comptes membres à Amazon Detective pour afficher les visualisations des données Detective relatives aux résultats et aux entités de ces comptes.

Il est recommandé d'utiliser le même compte GuardDuty administrateur que le compte administrateur pour Detective. Pour plus d'informations sur l'ajout de comptes membres dans Detective, consultez [la section Gestion des comptes](https://docs.aws.amazon.com/detective/latest/userguide/accounts.html) dans le *guide de l'utilisateur Amazon Detective*.

**Note**  
Detective est un service régional, ce qui signifie que vous devez l'activer Detective et ajouter vos comptes membres dans chaque région dans laquelle vous souhaitez utiliser l'intégration.