AWS GuardDuty detector is not enabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_238
Category - Subcategory	Monitoring - Unintegrated
Provider	AWS
Severity	LOW
Framework	Terraform
Mapped CSPM/KSPM Rule	2ba509d8-fab8-4585-a89b-2f2ddee1aaf5

Impact

Enabling the AWS GuardDuty detector can help protect your Amazon Web Services (AWS) resources from various types of threats, such as malware, data breaches, and unauthorized access. GuardDuty is a threat detection service that uses machine learning and other techniques to analyze data from various sources (such as VPC Flow Logs, AWS CloudTrail logs, and DNS logs) and identify potential security threats. By ensuring that the GuardDuty detector is enabled, you can take advantage of this service and receive alerts when potential threats are detected. This can help you take timely action to address any security issues and prevent security incidents from occurring.

How to Fix

[source,go]

resource "aws_guardduty_detector" "pass" { enable = true tags = { test = "Fail" } }