Cloud

AWS GuardDuty Findings

AWS GuardDuty threat detection findings across EC2, IAM, and S3 resources. Covers 8 categories — Recon, UnauthorizedAccess, Policy, Trojan, Impact, CryptoCurrency, Stealth, and Backdoor — with 27 finding types, 10 threat actor IPs, and geo/ASN enrichment.

View on GitHub

Quick Start

uv tool install eventum-generator
git clone https://github.com/eventum-generator/content-packs.git
cd content-packs
eventum generate \
  --path generators/cloud-aws-guardduty/generator.yml \
  --id guardduty \
  --live-mode true

Event Types

Event ID	Description	Frequency	Category
Recon:EC2/PortProbeUnprotectedPort	Unprotected port being probed by malicious host	~15%	recon
Recon:IAMUser/TorIPCaller	API invoked from Tor exit node or malicious IP	~10%	recon
UnauthorizedAccess:EC2/MaliciousIPCaller.Custom	EC2 instance communicating with disallowed IP	~12%	unauthorized-access
UnauthorizedAccess:IAMUser/ConsoleLoginSuccess.B	Unusual console login from new principal	~8%	unauthorized-access
Policy:S3/BucketBlockPublicAccessDisabled	S3 bucket public access block disabled	~10%	policy
Trojan:EC2/DGADomainRequest.B	EC2 querying algorithmically generated domains	~5%	trojan
CryptoCurrency:EC2/BitcoinTool.B!DNS	EC2 querying Bitcoin mining pool domains	~4%	cryptocurrency
Backdoor:EC2/DenialOfService.Tcp	EC2 may be participating in TCP DDoS attack	~2.5%	backdoor

Realism Features

Jinja2 macros eliminate boilerplate across 16 templates
8 finding categories — Recon (25%), UnauthorizedAccess (20%), Policy (15%), Trojan (10%), Impact (10%), CryptoCurrency (8%), Stealth (7%), Backdoor (5%)
3 resource types — Instance (EC2), AccessKey (IAM), S3Bucket with complete metadata
4 action types — NETWORK_CONNECTION, PORT_PROBE, AWS_API_CALL, DNS_REQUEST
Multi-account environment — 3 AWS accounts (production, staging, development)
15 EC2 instances with private/public IPs, VPC/subnet/security group details
10 threat actor IPs from 8 countries with ASN/ISP/geo data, including Tor exit nodes
14 malicious DNS domains — DGA-generated, crypto mining pools, C&C servers
Temporal realism — first_seen/last_seen windows spanning 1-72 hours
ECS rule fields — rule.category, rule.name, rule.ruleset for SIEM correlation

Sample Output

{
    "@timestamp": "2026-03-04T18:45:12.000Z",
    "aws": {
        "guardduty": {
            "account_id": "123456789012",
            "description": "EC2 instance i-0a1b2c3d4e5f67890 has an unprotected port which is being probed by a known malicious host.",
            "resource": {
                "instance_details": {
                    "instance_id": "i-0a1b2c3d4e5f67890",
                    "instance_type": "t3.medium",
                    "iam_instance_profile": {
                        "arn": "arn:aws:iam::123456789012:instance-profile/web-server-prod",
                        "id": "AIPA1A2B3C4D5E6F7G8H9"
                    },
                    "platform": null
                },
                "type": "Instance"
            },
            "service": {
                "action": {
                    "port_probe_action": {
                        "blocked": false,
                        "port_probe_details": [{
                            "local_port_details": {"port": 22, "port_name": "SSH"},
                            "remote_ip_details": {
                                "ip_address_v4": "198.51.100.200",
                                "organization": {"asn": "12389", "asnorg": "Rostelecom", "isp": "Rostelecom", "org": "Rostelecom"}
                            }
                        }]
                    },
                    "type": "PORT_PROBE"
                }
            },
            "confidence": 4.2,
            "severity": {"code": 2, "value": "Low"},
            "type": "Recon:EC2/PortProbeUnprotectedPort"
        }
    },
    "cloud": {
        "account": {"id": "123456789012"},
        "provider": "aws",
        "region": "us-east-1",
        "service": {"name": "guardduty"}
    },
    "event": {
        "action": "PORT_PROBE",
        "dataset": "aws.guardduty",
        "kind": "event",
        "module": "aws",
        "severity": 2,
        "type": ["info"]
    },
    "rule": {
        "category": "Recon",
        "name": "Recon:EC2/PortProbeUnprotectedPort",
        "ruleset": "Recon:EC2"
    }
}

Parameters

Parameter	Default	Description
agent_id	b2c3d4e5-...	Filebeat agent UUID
agent_version	8.17.0	Elastic Agent version

Related Generators

Cloud

AWS CloudTrail Management Events

AWS CloudTrail audit trail — API calls across EC2, IAM, STS, and S3 from a multi-account organization. Includes console logins, role assumptions, error injection, and 4 identity types.

Cloud

AWS VPC Flow Logs

AWS VPC Flow Logs (v5) — network traffic records across multiple accounts, VPCs, and subnets. TCP/UDP/ICMP flows with ACCEPT/REJECT actions, NAT gateway traffic, and realistic byte/packet distributions.

Cloud

Azure Activity Log

Azure Monitor Activity Log — control plane operations across VMs, storage, networking, and RBAC. Covers all 7 log categories: Administrative, Security, Service Health, Alert, Autoscale, Policy, and Recommendation.