How to do it...

We can configure GuardDuty to aggregate the findings from member accounts as follows:

  1. Go to the GuardDuty service in the main account console.
  2. Click on Accounts from the left sidebar.
  3. Click on Add accounts.
  1. Enter the Account ID and Email address for the member account: 

  1. Click on Add. The account details will be shown under Accounts to be added.
  2. Click Next. We should see our account under the Accounts page. The Status field will have a link to Invite the account we just added:

  1. Click on Invite under the Status column. We should get a pop-up screen to add an optional message and email notification to the admin of the other account. If you are handling both the accounts, you may leave this field empty and leave the selection for Also send an email notification to the root user on the invitee's AWS account and generate an alert in the invitee's Personal Health Dashboard unchecked:

  1. Click on Send invitation. The Status of our account should change to Invited.
  2. Go to the GuardDuty service in the member console.
  3. If we are logging in for the first time, we will get a Getting started page. Click on Get started. We will be taken to the Welcome to GuardDuty page. We should see a message stating that You have a membership invitation
  4. On the Welcome to GuardDuty page, click on Enable GuardDuty. We will be taken to the Invitations page:

You can also go to the Invitations page by clicking on Invitations from the left sidebar. 
  1. Click on the ACCEPT button and then click on Accept invitation
  2. Click on Settings from the left sidebar to go to the Settings page and click on Generate sample findings.
  3. Go to the GuardDuty dashboard in the main account and verify the findings. We should be able to see the findings from our member account.
..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.22.74.66