Skip to main content
All AWS integration capabilities

​
About

Amazon GuardDuty publishes every finding it generates to Amazon EventBridge. You deploy one EventBridge rule per Region that matches GuardDuty findings and sends each one to your Sazabi intake URL through an EventBridge API destination. Sazabi does not assume a role in your account. Each finding lands as one log record under service guardduty. The record body is the finding JSON, and these attributes are set from it: The record’s time is the finding’s updatedAt. Its level comes from GuardDuty’s severity scale: Low (1.0–3.9) is INFO, Medium (4.0–6.9) is WARN, High (7.0–8.9) is ERROR, and Critical (9.0–10.0) is FATAL.

​
Prerequisites

  • GuardDuty enabled in each Region you want covered.
  • Permission to create an EventBridge rule, an EventBridge connection and API destination, and an IAM role in the account that receives the findings.
  • Your Sazabi intake URL (shown above).
EventBridge rules are regional, and GuardDuty publishes each Region’s findings only in that Region. Deploy the stack or module in every Region where GuardDuty is enabled. With AWS Organizations, deploy it in the GuardDuty delegated administrator account: its rules also match the findings of every member account.

​
Set up in the dashboard

1

​
Deploy the EventBridge rule and API destination

The setup screen shows a CloudFormation template and the same resources as Terraform, both with your intake URL filled in. They create:
  • An EventBridge connection. EventBridge requires an authorization method on every connection, so it sends a fixed x-sazabi-source: aws-guardduty header. The header is not a secret and Sazabi ignores it; the intake URL carries the credential.
  • An API destination that sends a POST to your intake URL.
  • An IAM role that EventBridge assumes, allowed only events:InvokeApiDestination on that API destination.
  • An EventBridge rule with this event pattern, targeting the API destination:
With CloudFormation, save the template to a file and create a stack from it in the AWS CloudFormation console in each Region, acknowledging that the stack creates an IAM role. With Terraform, add the resources to the configuration for each account and Region and run terraform apply.
2

​
Generate a sample finding

In a Region where you deployed the rule, generate one sample finding with the AWS CLI:
Sample findings have [SAMPLE] in their title and aws.guardduty.finding.sample set to true.

​
Set up with the CLI

You can also register the AWS GuardDuty log source with the Sazabi CLI (installed and authenticated — see CLI reference):
The command prints the intake URL for the new source. Run sazabi log-sources setup-instructions <log-source-id> with the new source’s ID to print the CloudFormation template and Terraform resources with that URL filled in, then deploy them as described above. One log source serves every Region and account you deploy the rule to.

​
Verify

After generating a sample finding, open the Intake page in the Sazabi dashboard and confirm the finding appears in the AWS GuardDuty source within a few minutes. Start a thread and ask for recent GuardDuty findings by aws.guardduty.finding.type to confirm the attributes are queryable.

​
Troubleshooting

No findings arriving — Confirm the rule exists in the same Region as the finding and targets the API destination. In CloudWatch, check the rule’s FailedInvocations metric (namespace AWS/Events). An IAM error there means the role lacks events:InvokeApiDestination on the API destination, or its trust policy does not name events.amazonaws.com. Member account findings missing — The rule must be in the GuardDuty administrator account, and the member must be associated with that administrator in the Region. Repeat occurrences arrive late — GuardDuty sends new findings in near real time but groups later occurrences of an existing finding and sends them every 6 hours by default. The administrator account can set Frequency for updated findings to 1 hour or 15 minutes in the GuardDuty Settings. Intake URL stopped working — The intake URL encodes your project public key. If you rotate or delete it in Settings > Public keys, create a new log source and update the API destination’s endpoint in every Region.

​
Further reading

Intake

See per-source ingestion volume and health.

AWS CloudWatch

Stream CloudWatch log groups from the same AWS account.

Log sources

Browse the full log source catalog.