developersIO
AWS Security Hub CSPM 経由の GuardDuty 通知においてサンプル検出を通知させない EventBridge イベントパターンを試してみた

AWS Security Hub CSPM 経由の GuardDuty 通知においてサンプル検出を通知させない EventBridge イベントパターンを試してみた

Security Hub CSPM 経由で GuardDuty 検出を通知している環境において、EventBridge ルールのイベントパターンを使ってサンプルを通知の対象外とする方法を試したので紹介します。
Amazon GuardDutyAmazon EventBridgeAWS CLIAWS
2026.08.11

AWS Security Hub CSPM 経由で Amazon GuardDuty の検出を通知する場合において、利用する EventBridge ルールのイベントパターンでサンプルの検出結果を除外する方法を試したので紹介します。
検出内容を AWS DevOps Agent で自動調査する環境において、サンプルを調査の対象から除外することでコスト削減できる、などのユースケースがあります。

本ブログでは、下記ブログの内容で EventBridge ルールを設定している環境で試しています。イベントパターン以外の設定に関しては記載していませんので、下記ブログをご参考にしてください。

https://dev.classmethod.jp/articles/guardduty-notification-via-securityhub/

GuardDuty のサンプルを除外するイベントパターン

すべてのサンプルを通知対象外とする場合は、検出結果内にある Sample フィールドを条件に追加することでシンプルに実現できました。サンプルの検出結果は Sample フィールドが true となるため、このパターンにはマッチしません。

{
  "source": ["aws.securityhub"],
  "detail-type": ["Security Hub Findings - Imported"],
  "detail": {
    "findings": {
      "ProductName": ["GuardDuty"],
      "Severity": {
        "Label": ["LOW", "MEDIUM", "HIGH", "CRITICAL"]
      },
      "Sample": [false]
    }
  }
}

すべてのサンプルを除外するのではなく、テストのために 1 種類のサンプルだけは通知させたい場合は $or 条件を利用して下記イベントパターンで実現できました。Backdoor:EC2/DenialOfService.Dns のサンプルだけは通知されます。Types フィールドでは / が - に変換される点には注意が必要です。

{
  "source": ["aws.securityhub"],
  "detail-type": ["Security Hub Findings - Imported"],
  "detail": {
    "findings": {
      "ProductName": ["GuardDuty"],
      "Severity": {
        "Label": ["LOW", "MEDIUM", "HIGH", "CRITICAL"]
      },
      "$or": [
        { "Sample": [false] },
        { "Types": ["TTPs/Command and Control/Backdoor:EC2-DenialOfService.Dns"] }
      ]
    }
  }
}

テストのために Backdoor:EC2/DenialOfService.Dns のサンプルを 1 つだけ作成する AWS CLI コマンドは下記です。AWS CloudShell から実行もできます。

aws guardduty create-sample-findings \
  --detector-id $(aws guardduty list-detectors --query 'DetectorIds[0]' --output text) \
  --finding-types "Backdoor:EC2/DenialOfService.Dns"

通知されないサンプルもテストしたい場合は、Backdoor:EC2/C&CActivity.B のサンプルを 1 つだけ作成するコマンドは下記です。

aws guardduty create-sample-findings \
  --detector-id $(aws guardduty list-detectors --query 'DetectorIds[0]' --output text) \
  --finding-types "Backdoor:EC2/C&CActivity.B"

イベントパターンのテスト

上記で紹介した 2 つのイベントパターンをテストしてみました。
テストしたパターンは下表です。サンプルの検出は Sample 列が true の項目です。

# 検出タイプ（GuardDuty） 重要度 Sample パターン 1 パターン 2
1 Stealth:IAMUser/CloudTrailLoggingDisabled Low false マッチする マッチする
2 Discovery:IAMUser/AnomalousBehavior Low true マッチしない マッチしない
3 Backdoor:EC2/DenialOfService.Dns High true マッチしない マッチする
4 Backdoor:EC2/C&CActivity.B High true マッチしない マッチしない

パターン 1 のイベントパターンは、全てのサンプルを対象外とするパターンです。

{
  "source": ["aws.securityhub"],
  "detail-type": ["Security Hub Findings - Imported"],
  "detail": {
    "findings": {
      "ProductName": ["GuardDuty"],
      "Severity": {
        "Label": ["LOW", "MEDIUM", "HIGH", "CRITICAL"]
      },
      "Sample": [false]
    }
  }
}

パターン 2 のイベントパターンは、サンプルは対象外だが Backdoor:EC2/DenialOfService.Dns サンプルだけは対象とするパターンです。

{
  "source": ["aws.securityhub"],
  "detail-type": ["Security Hub Findings - Imported"],
  "detail": {
    "findings": {
      "ProductName": ["GuardDuty"],
      "Severity": {
        "Label": ["LOW", "MEDIUM", "HIGH", "CRITICAL"]
      },
      "$or": [
        { "Sample": [false] },
        { "Types": ["TTPs/Command and Control/Backdoor:EC2-DenialOfService.Dns"] }
      ]
    }
  }
}

EventBridge には、イベントパターンをテストできるサンドボックス機能があります。マネジメントコンソールから利用する場合は「デベロッパーリソース」における「サンドボックス」メニューです。

AWS CLI から実行する場合は test-event-pattern コマンドです。今回は CLI でテストします。

aws events test-event-pattern \
  --event-pattern file://event-pattern.json \
  --event file://event.json

event-pattern で指定するのはイベントパターンです。上述した 2 パターンに対応する次のファイルを用意しました。

cat << 'EOF' > event-pattern-exclude-all-samples.json
{
  "source": ["aws.securityhub"],
  "detail-type": ["Security Hub Findings - Imported"],
  "detail": {
    "findings": {
      "ProductName": ["GuardDuty"],
      "Severity": {
        "Label": ["LOW", "MEDIUM", "HIGH", "CRITICAL"]
      },
      "Sample": [false]
    }
  }
}
EOF

cat << 'EOF' > event-pattern-allow-dos-dns-sample.json
{
  "source": ["aws.securityhub"],
  "detail-type": ["Security Hub Findings - Imported"],
  "detail": {
    "findings": {
      "ProductName": ["GuardDuty"],
      "Severity": {
        "Label": ["LOW", "MEDIUM", "HIGH", "CRITICAL"]
      },
      "$or": [
        { "Sample": [false] },
        { "Types": ["TTPs/Command and Control/Backdoor:EC2-DenialOfService.Dns"] }
      ]
    }
  }
}
EOF

event で利用するファイルの内容は、一度全ての GuardDuty 検出を通知するルールを作成し、実際にメール通知させることで取得しました（もっと簡単な方法があるかもしれません）。#1 の実際の検出内容は CloudTrail 証跡のログ記録をオフにすることで検出されます。取得した検出内容を基に下表のファイル名で作成しました。

# 検出タイプ（GuardDuty） 重要度 Sample event で指定するファイル名
1 Stealth:IAMUser/CloudTrailLoggingDisabled Low false test-event-01-real-cloudtrail-logging-disabled.json
2 Discovery:IAMUser/AnomalousBehavior Low true test-event-02-sample-anomalous-behavior.json
3 Backdoor:EC2/DenialOfService.Dns High true test-event-03-sample-dos-dns.json
4 Backdoor:EC2/C&CActivity.B High true test-event-04-sample-c2-activity-b.json

テストで利用したイベントをマスキングした内容を掲載します。長いので折りたたんでいます。また、1 記事あたりの文字数上限を超えてしまったため test-event-04-sample-c2-activity-b.json の掲載は略しています。

test-event-01-real-cloudtrail-logging-disabled.json
{
    "version": "0",
    "id": "ef9007fe-f26d-8464-bfc4-391f02512460",
    "detail-type": "Security Hub Findings - Imported",
    "source": "aws.securityhub",
    "account": "111122223333",
    "time": "2026-08-11T04:58:41Z",
    "region": "ap-northeast-1",
    "resources": [
        "arn:aws:securityhub:ap-northeast-1::product/aws/guardduty/arn:aws:guardduty:ap-northeast-1:111122223333:detector/4ccbc43540ba7006fa3ea782cexample/finding/6acff7979cbc498f13f5748413e9e64c"
    ],
    "detail": {
        "findings": [
            {
                "ProductArn": "arn:aws:securityhub:ap-northeast-1::product/aws/guardduty",
                "Types": [
                    "TTPs/Defense Evasion/Stealth:IAMUser-CloudTrailLoggingDisabled"
                ],
                "SourceUrl": "https://ap-northeast-1.console.aws.amazon.com/guardduty/home?region=ap-northeast-1#/findings?macros=current&fId=6acff7979cbc498f13f5748413e9e64c",
                "Action": {
                    "ActionType": "AWS_API_CALL",
                    "AwsApiCallAction": {
                        "AffectedResources": {
                            "AWS::CloudTrail::Trail": "arn:aws:cloudtrail:ap-northeast-1:111122223333:trail/test-cloudtrail"
                        },
                        "ServiceName": "cloudtrail.amazonaws.com",
                        "RemoteIpDetails": {
                            "IpAddressV4": "192.0.2.1",
                            "Organization": {
                                "Org": "XXX",
                                "Isp": "XXX",
                                "AsnOrg": "XXX,Inc.",
                                "Asn": 0
                            },
                            "Country": {
                                "CountryName": "Japan",
                                "CountryCode": "JP"
                            },
                            "City": {
                                "CityName": "xxx"
                            },
                            "GeoLocation": {
                                "Lon": 0,
                                "Lat": 0
                            }
                        },
                        "Api": "StopLogging",
                        "CallerType": "remoteIp"
                    }
                },
                "Description": "AWS CloudTrail trail arn:aws:cloudtrail:ap-northeast-1:111122223333:trail/test-cloudtrail was disabled by AWSReservedSSO_AdministratorAccess_cdexampleexample calling StopLogging under unusual circumstances. This can be attackers attempt to cover their tracks by eliminating any trace of activity performed while they accessed your account.",
                "ProductName": "GuardDuty",
                "FirstObservedAt": "2026-08-11T04:46:51.000Z",
                "CreatedAt": "2026-08-11T04:57:57.368Z",
                "LastObservedAt": "2026-08-11T04:46:51.000Z",
                "CompanyName": "Amazon",
                "FindingProviderFields": {
                    "Types": [
                        "TTPs/Defense Evasion/Stealth:IAMUser-CloudTrailLoggingDisabled"
                    ],
                    "Severity": {
                        "Normalized": 40,
                        "Label": "LOW",
                        "Product": 2
                    }
                },
                "ProductFields": {
                    "aws/guardduty/service/action/actionType": "AWS_API_CALL",
                    "aws/guardduty/service/action/awsApiCallAction/affectedResources/AWS::CloudTrail::Trail": "arn:aws:cloudtrail:ap-northeast-1:111122223333:trail/test-cloudtrail",
                    "aws/guardduty/service/action/awsApiCallAction/api": "StopLogging",
                    "aws/guardduty/service/action/awsApiCallAction/callerType": "Remote IP",
                    "aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/city/cityName": "xxx",
                    "aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/country/countryName": "Japan",
                    "aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/geoLocation/lat": "xxx",
                    "aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/geoLocation/lon": "xxx",
                    "aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/ipAddressV4": "192.0.2.1",
                    "aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/organization/asn": "4713",
                    "aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/organization/asnOrg": "XXX,Inc.",
                    "aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/organization/isp": "XXX",
                    "aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/organization/org": "XXX",
                    "aws/guardduty/service/action/awsApiCallAction/serviceName": "cloudtrail.amazonaws.com",
                    "aws/guardduty/service/additionalInfo/value": "",
                    "aws/guardduty/service/additionalInfo/type": "default",
                    "aws/guardduty/service/archived": "false",
                    "aws/guardduty/service/count": "1",
                    "aws/guardduty/service/detectorId": "4ccbc43540ba7006fa3ea782cexample",
                    "aws/guardduty/service/eventFirstSeen": "2026-08-11T04:46:51.000Z",
                    "aws/guardduty/service/eventLastSeen": "2026-08-11T04:46:51.000Z",
                    "aws/guardduty/service/resourceRole": "TARGET",
                    "aws/guardduty/service/serviceName": "guardduty",
                    "aws/securityhub/FindingId": "arn:aws:securityhub:ap-northeast-1::product/aws/guardduty/arn:aws:guardduty:ap-northeast-1:111122223333:detector/4ccbc43540ba7006fa3ea782cexample/finding/6acff7979cbc498f13f5748413e9e64c",
                    "aws/securityhub/ProductName": "GuardDuty",
                    "aws/securityhub/CompanyName": "Amazon"
                },
                "SchemaVersion": "2018-10-08",
                "GeneratorId": "arn:aws:guardduty:ap-northeast-1:111122223333:detector/4ccbc43540ba7006fa3ea782cexample",
                "Sample": false,
                "RecordState": "ACTIVE",
                "Title": "An AWS CloudTrail trail arn:aws:cloudtrail:ap-northeast-1:111122223333:trail/test-cloudtrail was disabled.",
                "Workflow": {
                    "Status": "NEW"
                },
                "Severity": {
                    "Normalized": 40,
                    "Label": "LOW",
                    "Product": 2
                },
                "UpdatedAt": "2026-08-11T04:57:57.368Z",
                "WorkflowState": "NEW",
                "AwsAccountName": "Audit",
                "AwsAccountId": "111122223333",
                "Region": "ap-northeast-1",
                "Id": "arn:aws:guardduty:ap-northeast-1:111122223333:detector/4ccbc43540ba7006fa3ea782cexample/finding/6acff7979cbc498f13f5748413e9e64c",
                "Resources": [
                    {
                        "Partition": "aws",
                        "Type": "AwsIamAccessKey",
                        "Owner": {
                            "Account": {
                                "Id": "111122223333"
                            }
                        },
                        "Details": {
                            "AwsIamAccessKey": {
                                "PrincipalId": "AROA2CFC5RFWPBEXAMPLE:aws@example.net",
                                "PrincipalName": "AWSReservedSSO_AdministratorAccess_cdexampleexample",
                                "PrincipalType": "AssumedRole"
                            }
                        },
                        "Region": "ap-northeast-1",
                        "Id": "AWS::IAM::AccessKey:ASIA2CFC5RFWFEXAMPLE",
                        "Provider": "AWS"
                    }
                ],
                "ProcessedAt": "2026-08-11T04:58:32.952Z"
            }
        ]
    }
}
test-event-02-sample-anomalous-behavior.json
{
    "version": "0",
    "id": "0a14f3e0-91a7-f5e2-9ab0-64093133a2d7",
    "detail-type": "Security Hub Findings - Imported",
    "source": "aws.securityhub",
    "account": "111122223333",
    "time": "2026-08-11T07:44:40Z",
    "region": "ap-northeast-1",
    "resources": [
        "arn:aws:securityhub:ap-northeast-1::product/aws/guardduty/arn:aws:guardduty:ap-northeast-1:111122223333:detector/4ccbc43540ba7006fa3ea782cexample/finding/72d0d608307e4ea5b654fa1892eb4604"
    ],
    "detail": {
        "findings": [
            {
                "ProductArn": "arn:aws:securityhub:ap-northeast-1::product/aws/guardduty",
                "Types": [
                    "TTPs/Discovery/IAMUser-AnomalousBehavior"
                ],
                "SourceUrl": "https://ap-northeast-1.console.aws.amazon.com/guardduty/home?region=ap-northeast-1#/findings?macros=current&fId=72d0d608307e4ea5b654fa1892eb4604",
                "Action": {
                    "ActionType": "AWS_API_CALL",
                    "AwsApiCallAction": {
                        "ServiceName": "GeneratedFindingAPIServiceName",
                        "RemoteIpDetails": {
                            "IpAddressV4": "198.51.100.0",
                            "Organization": {
                                "Org": "GeneratedFindingOrg",
                                "Isp": "GeneratedFindingISP",
                                "AsnOrg": "GeneratedFindingASNOrg"
                            },
                            "Country": {
                                "CountryName": "GeneratedFindingCountryName"
                            },
                            "City": {
                                "CityName": "GeneratedFindingCityName"
                            },
                            "GeoLocation": {
                                "Lon": 0,
                                "Lat": 0
                            }
                        },
                        "Api": "GeneratedFindingAPIName",
                        "CallerType": "remoteIp"
                    }
                },
                "Description": "APIs commonly used in Discovery tactics were invoked by user IAMUser : GeneratedFindingUserName under unusual circumstances. Such activity is not typically seen from this user.",
                "ProductName": "GuardDuty",
                "FirstObservedAt": "2026-06-27T01:30:34.000Z",
                "CreatedAt": "2026-06-27T01:30:34.135Z",
                "LastObservedAt": "2026-08-11T07:44:27.000Z",
                "CompanyName": "Amazon",
                "FindingProviderFields": {
                    "Types": [
                        "TTPs/Discovery/IAMUser-AnomalousBehavior"
                    ],
                    "Severity": {
                        "Normalized": 40,
                        "Label": "LOW",
                        "Product": 2
                    }
                },
                "ProductFields": {
                    "aws/guardduty/service/serviceName": "guardduty",
                    "aws/guardduty/service/detectorId": "4ccbc43540ba7006fa3ea782cexample",
                    "aws/guardduty/service/featureName": "CloudTrailManagementEvent",
                    "aws/guardduty/service/action/actionType": "AWS_API_CALL",
                    "aws/guardduty/service/action/awsApiCallAction/api": "GeneratedFindingAPIName",
                    "aws/guardduty/service/action/awsApiCallAction/serviceName": "GeneratedFindingAPIServiceName",
                    "aws/guardduty/service/action/awsApiCallAction/callerType": "Remote IP",
                    "aws/guardduty/service/action/awsApiCallAction/errorCode": "AccessDenied",
                    "aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/ipAddressV4": "198.51.100.0",
                    "aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/organization/asn": "-1",
                    "aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/organization/asnOrg": "GeneratedFindingASNOrg",
                    "aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/organization/isp": "GeneratedFindingISP",
                    "aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/organization/org": "GeneratedFindingOrg",
                    "aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/country/countryName": "GeneratedFindingCountryName",
                    "aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/city/cityName": "GeneratedFindingCityName",
                    "aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/geoLocation/lat": "0",
                    "aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/geoLocation/lon": "0",
                    "aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/ipAddressV6": "1234:5678:90ab:cdef:1234:5678:90ab:cde0",
                    "aws/guardduty/service/action/awsApiCallAction/affectedResources": "",
                    "aws/guardduty/service/resourceRole": "TARGET",
                    "aws/guardduty/service/additionalInfo/userAgent/fullUserAgent": "GeneratedFindingFullUserAgent",
                    "aws/guardduty/service/additionalInfo/userAgent/userAgentCategory": "GeneratedFindingUserAgentCategory",
                    "aws/guardduty/service/additionalInfo/anomalies/anomalousAPIs": "GeneratedFindingAPIServiceName:[GeneratedFindingAPIName:AccessDenied , GeneratedFindingAPINameTwo:AccessDenied] , GeneratedFindingAPIServiceNameThree:[GeneratedFindingAPINameThree:success] , GeneratedFindingAPIServiceNameFour:[GeneratedFindingAPINameFour:success]",
                    "aws/guardduty/service/additionalInfo/profiledBehavior/rareProfiledAPIsAccountProfiling": "GeneratedFindingAPINameTwo , GeneratedFindingAPINameThree",
                    "aws/guardduty/service/additionalInfo/profiledBehavior/infrequentProfiledAPIsAccountProfiling": "GeneratedFindingAPINameFour",
                    "aws/guardduty/service/additionalInfo/profiledBehavior/frequentProfiledAPIsAccountProfiling": "GeneratedFindingAPINameFive , GeneratedFindingAPINameSix",
                    "aws/guardduty/service/additionalInfo/profiledBehavior/rareProfiledAPIsUserIdentityProfiling": "GeneratedFindingAPINameTwo",
                    "aws/guardduty/service/additionalInfo/profiledBehavior/infrequentProfiledAPIsUserIdentityProfiling": "GeneratedFindingAPINameSix",
                    "aws/guardduty/service/additionalInfo/profiledBehavior/frequentProfiledAPIsUserIdentityProfiling": "GeneratedFindingAPINameFive",
                    "aws/guardduty/service/additionalInfo/profiledBehavior/rareProfiledUserTypesAccountProfiling": "GeneratedFindingUserType",
                    "aws/guardduty/service/additionalInfo/profiledBehavior/infrequentProfiledUserTypesAccountProfiling": "",
                    "aws/guardduty/service/additionalInfo/profiledBehavior/frequentProfiledUserTypesAccountProfiling": "ASSUMED_ROLE",
                    "aws/guardduty/service/additionalInfo/profiledBehavior/rareProfiledUserNamesAccountProfiling": "GeneratedFindingUserName , GeneratedFindingUserNameTwo",
                    "aws/guardduty/service/additionalInfo/profiledBehavior/infrequentProfiledUserNamesAccountProfiling": "",
                    "aws/guardduty/service/additionalInfo/profiledBehavior/frequentProfiledUserNamesAccountProfiling": "GeneratedFindingUserNameTwoThree",
                    "aws/guardduty/service/additionalInfo/profiledBehavior/rareProfiledASNsAccountProfiling": "",
                    "aws/guardduty/service/additionalInfo/profiledBehavior/infrequentProfiledASNsAccountProfiling": "",
                    "aws/guardduty/service/additionalInfo/profiledBehavior/frequentProfiledASNsAccountProfiling": "asnNumber: GeneratedFindingASNOne asnOrg: GeneratedFindingASNOrgOne",
                    "aws/guardduty/service/additionalInfo/profiledBehavior/rareProfiledASNsUserIdentityProfiling": "asnNumber: GeneratedFindingASNOne asnOrg: GeneratedFindingASNOrgOne",
                    "aws/guardduty/service/additionalInfo/profiledBehavior/infrequentProfiledASNsUserIdentityProfiling": "",
                    "aws/guardduty/service/additionalInfo/profiledBehavior/frequentProfiledASNsUserIdentityProfiling": "",
                    "aws/guardduty/service/additionalInfo/profiledBehavior/rareProfiledUserAgentsAccountProfiling": "GeneratedFindingUserAgentOne , GeneratedFindingUserAgentTwo , GeneratedFindingUserAgentThree",
                    "aws/guardduty/service/additionalInfo/profiledBehavior/infrequentProfiledUserAgentsAccountProfiling": "",
                    "aws/guardduty/service/additionalInfo/profiledBehavior/frequentProfiledUserAgentsAccountProfiling": "AWS Service , AWS Internal",
                    "aws/guardduty/service/additionalInfo/profiledBehavior/rareProfiledUserAgentsUserIdentityProfiling": "GeneratedFindingUserAgentOne",
                    "aws/guardduty/service/additionalInfo/profiledBehavior/infrequentProfiledUserAgentsUserIdentityProfiling": "",
                    "aws/guardduty/service/additionalInfo/profiledBehavior/frequentProfiledUserAgentsUserIdentityProfiling": "",
                    "aws/guardduty/service/additionalInfo/unusualBehavior/unusualAPIsAccountProfiling": "GeneratedFindingAPIName",
                    "aws/guardduty/service/additionalInfo/unusualBehavior/unusualAPIsUserIdentityProfiling": "GeneratedFindingAPIName",
                    "aws/guardduty/service/additionalInfo/unusualBehavior/unusualUserTypesAccountProfiling": "",
                    "aws/securityhub/FindingId": "arn:aws:securityhub:ap-northeast-1::product/aws/guardduty/arn:aws:guardduty:ap-northeast-1:111122223333:detector/4ccbc43540ba7006fa3ea782cexample/finding/72d0d608307e4ea5b654fa1892eb4604",
                    "aws/securityhub/ProductName": "GuardDuty",
                    "aws/securityhub/CompanyName": "Amazon"
                },
                "SchemaVersion": "2018-10-08",
                "GeneratorId": "arn:aws:guardduty:ap-northeast-1:111122223333:detector/4ccbc43540ba7006fa3ea782cexample",
                "Sample": true,
                "RecordState": "ACTIVE",
                "Title": "The user IAMUser : GeneratedFindingUserName is anomalously invoking APIs commonly used in Discovery tactics.",
                "Workflow": {
                    "Status": "NEW"
                },
                "Severity": {
                    "Normalized": 40,
                    "Label": "LOW",
                    "Product": 2
                },
                "UpdatedAt": "2026-08-11T07:44:27.438Z",
                "WorkflowState": "NEW",
                "AwsAccountName": "Audit",
                "AwsAccountId": "111122223333",
                "Region": "ap-northeast-1",
                "Id": "arn:aws:guardduty:ap-northeast-1:111122223333:detector/4ccbc43540ba7006fa3ea782cexample/finding/72d0d608307e4ea5b654fa1892eb4604",
                "Resources": [
                    {
                        "Partition": "aws",
                        "Type": "AwsEc2Instance",
                        "Owner": {
                            "Account": {
                                "Id": "111122223333"
                            }
                        },
                        "Details": {
                            "AwsEc2Instance": {
                                "Type": "m3.xlarge",
                                "VpcId": "vpc-generatedvpcid1",
                                "ImageId": "ami-99999999",
                                "IpV4Addresses": [
                                    "198.51.100.1",
                                    "198.51.100.2",
                                    "198.51.100.3",
                                    "198.51.100.4",
                                    "10.0.0.4",
                                    "10.0.0.3",
                                    "10.0.0.2",
                                    "10.0.0.1"
                                ],
                                "SubnetId": "GeneratedFindingSubnetId1",
                                "LaunchedAt": "2016-08-02T02:05:06.000Z",
                                "IamInstanceProfileArn": "arn:aws:iam::111122223333:instance-profile/generated"
                            }
                        },
                        "Region": "ap-northeast-1",
                        "Id": "arn:aws:ec2:ap-northeast-1:111122223333:instance/i-99999999",
                        "Tags": {
                            "GeneratedFindingInstaceTag1": "GeneratedFindingInstaceValue1",
                            "GeneratedFindingInstaceTag2": "GeneratedFindingInstaceTagValue2",
                            "GeneratedFindingInstaceTag3": "GeneratedFindingInstaceTagValue3",
                            "GeneratedFindingInstaceTag4": "GeneratedFindingInstaceTagValue4",
                            "GeneratedFindingInstaceTag5": "GeneratedFindingInstaceTagValue5",
                            "GeneratedFindingInstaceTag6": "GeneratedFindingInstaceTagValue6",
                            "GeneratedFindingInstaceTag7": "GeneratedFindingInstaceTagValue7",
                            "GeneratedFindingInstaceTag8": "GeneratedFindingInstaceTagValue8",
                            "GeneratedFindingInstaceTag9": "GeneratedFindingInstaceTagValue9"
                        },
                        "Provider": "AWS"
                    },
                    {
                        "Partition": "aws",
                        "Type": "AwsIamAccessKey",
                        "Owner": {
                            "Account": {
                                "Id": "111122223333"
                            }
                        },
                        "Details": {
                            "AwsIamAccessKey": {
                                "PrincipalId": "GeneratedFindingPrincipalId",
                                "PrincipalName": "GeneratedFindingUserName",
                                "PrincipalType": "IAMUser"
                            }
                        },
                        "Region": "ap-northeast-1",
                        "Id": "AWS::IAM::AccessKey:GeneratedFindingAccessKeyId",
                        "Provider": "AWS"
                    }
                ],
                "ProcessedAt": "2026-08-11T07:44:33.953Z"
            }
        ]
    }
}
test-event-03-sample-dos-dns.json
{
    "version": "0",
    "id": "c0870476-114c-7eda-e591-da6792a4862b",
    "detail-type": "Security Hub Findings - Imported",
    "source": "aws.securityhub",
    "account": "111122223333",
    "time": "2026-08-11T07:44:49Z",
    "region": "ap-northeast-1",
    "resources": [
        "arn:aws:securityhub:ap-northeast-1::product/aws/guardduty/arn:aws:guardduty:ap-northeast-1:111122223333:detector/4ccbc43540ba7006fa3ea782cexample/finding/6e961ad188cb4b67b375ae1a48595c64"
    ],
    "detail": {
        "findings": [
            {
                "ProductArn": "arn:aws:securityhub:ap-northeast-1::product/aws/guardduty",
                "Types": [
                    "TTPs/Command and Control/Backdoor:EC2-DenialOfService.Dns"
                ],
                "SourceUrl": "https://ap-northeast-1.console.aws.amazon.com/guardduty/home?region=ap-northeast-1#/findings?macros=current&fId=6e961ad188cb4b67b375ae1a48595c64",
                "Action": {
                    "ActionType": "NETWORK_CONNECTION",
                    "NetworkConnectionAction": {
                        "LocalPortDetails": {
                            "Port": 24198,
                            "PortName": "Unknown"
                        },
                        "RemoteIpDetails": {
                            "IpAddressV4": "198.51.100.0",
                            "Organization": {
                                "Org": "GeneratedFindingORG",
                                "Isp": "GeneratedFindingISP",
                                "AsnOrg": "GeneratedFindingASNOrg"
                            },
                            "Country": {
                                "CountryName": "GeneratedFindingCountryName"
                            },
                            "City": {
                                "CityName": "GeneratedFindingCityName"
                            },
                            "GeoLocation": {
                                "Lon": 0,
                                "Lat": 0
                            }
                        },
                        "Protocol": "UDP",
                        "Blocked": false,
                        "ConnectionDirection": "OUTBOUND",
                        "RemotePortDetails": {
                            "Port": 53,
                            "PortName": "DNS"
                        }
                    }
                },
                "Description": "The EC2 instance i-99999999 is behaving in a manner that may indicate it is being used to perform a Denial of Service (DoS) attack using the DNS protocol.",
                "ProductName": "GuardDuty",
                "FirstObservedAt": "2026-06-27T01:30:19.000Z",
                "CreatedAt": "2026-06-27T01:30:19.037Z",
                "LastObservedAt": "2026-08-11T07:44:31.000Z",
                "CompanyName": "Amazon",
                "FindingProviderFields": {
                    "Types": [
                        "TTPs/Command and Control/Backdoor:EC2-DenialOfService.Dns"
                    ],
                    "Severity": {
                        "Normalized": 75,
                        "Label": "HIGH",
                        "Product": 8
                    }
                },
                "ProductFields": {
                    "aws/guardduty/service/serviceName": "guardduty",
                    "aws/guardduty/service/detectorId": "4ccbc43540ba7006fa3ea782cexample",
                    "aws/guardduty/service/featureName": "VpcFlowLogs",
                    "aws/guardduty/service/action/actionType": "NETWORK_CONNECTION",
                    "aws/guardduty/service/action/networkConnectionAction/connectionDirection": "OUTBOUND",
                    "aws/guardduty/service/action/networkConnectionAction/localIpDetails/ipAddressV4": "10.0.0.23",
                    "aws/guardduty/service/action/networkConnectionAction/localIpDetails/ipAddressV6": "1234:5678:90ab:cdef:1234:5678:90ab:cde1",
                    "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/ipAddressV4": "198.51.100.0",
                    "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/organization/asn": "-1",
                    "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/organization/asnOrg": "GeneratedFindingASNOrg",
                    "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/organization/isp": "GeneratedFindingISP",
                    "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/organization/org": "GeneratedFindingORG",
                    "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/country/countryName": "GeneratedFindingCountryName",
                    "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/city/cityName": "GeneratedFindingCityName",
                    "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/geoLocation/lat": "0",
                    "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/geoLocation/lon": "0",
                    "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/ipAddressV6": "1234:5678:90ab:cdef:1234:5678:90ab:cde0",
                    "aws/guardduty/service/action/networkConnectionAction/remotePortDetails/port": "53",
                    "aws/guardduty/service/action/networkConnectionAction/remotePortDetails/portName": "DNS",
                    "aws/guardduty/service/action/networkConnectionAction/localPortDetails/port": "24198",
                    "aws/guardduty/service/action/networkConnectionAction/localPortDetails/portName": "Unknown",
                    "aws/guardduty/service/action/networkConnectionAction/localNetworkInterface": "eni-abcdef00",
                    "aws/guardduty/service/action/networkConnectionAction/protocol": "UDP",
                    "aws/guardduty/service/action/networkConnectionAction/blocked": "false",
                    "aws/guardduty/service/resourceRole": "ACTOR",
                    "aws/guardduty/service/additionalInfo/sample": "true",
                    "aws/guardduty/service/additionalInfo/value": "{\"sample\":true}",
                    "aws/guardduty/service/additionalInfo/type": "default",
                    "aws/guardduty/service/eventFirstSeen": "2026-06-27T01:30:19.000Z",
                    "aws/guardduty/service/eventLastSeen": "2026-08-11T07:44:31.000Z",
                    "aws/guardduty/service/archived": "false",
                    "aws/guardduty/service/count": "9",
                    "aws/securityhub/FindingId": "arn:aws:securityhub:ap-northeast-1::product/aws/guardduty/arn:aws:guardduty:ap-northeast-1:111122223333:detector/4ccbc43540ba7006fa3ea782cexample/finding/6e961ad188cb4b67b375ae1a48595c64",
                    "aws/securityhub/ProductName": "GuardDuty",
                    "aws/securityhub/CompanyName": "Amazon"
                },
                "SchemaVersion": "2018-10-08",
                "GeneratorId": "arn:aws:guardduty:ap-northeast-1:111122223333:detector/4ccbc43540ba7006fa3ea782cexample",
                "Sample": true,
                "RecordState": "ACTIVE",
                "Title": "The EC2 instance i-99999999 is behaving in a manner that may indicate it is being used to perform a Denial of Service (DoS) attack using the DNS protocol.",
                "Workflow": {
                    "Status": "NEW"
                },
                "Severity": {
                    "Normalized": 75,
                    "Label": "HIGH",
                    "Product": 8
                },
                "UpdatedAt": "2026-08-11T07:44:31.820Z",
                "WorkflowState": "NEW",
                "AwsAccountName": "Audit",
                "AwsAccountId": "111122223333",
                "Region": "ap-northeast-1",
                "Id": "arn:aws:guardduty:ap-northeast-1:111122223333:detector/4ccbc43540ba7006fa3ea782cexample/finding/6e961ad188cb4b67b375ae1a48595c64",
                "Resources": [
                    {
                        "Partition": "aws",
                        "Type": "AwsEc2Instance",
                        "Details": {
                            "AwsEc2Instance": {
                                "Type": "m3.xlarge",
                                "VpcId": "vpc-generatedvpcid1",
                                "ImageId": "ami-99999999",
                                "IpV4Addresses": [
                                    "198.51.100.1",
                                    "198.51.100.2",
                                    "198.51.100.3",
                                    "198.51.100.4",
                                    "10.0.0.4",
                                    "10.0.0.3",
                                    "10.0.0.2",
                                    "10.0.0.1"
                                ],
                                "SubnetId": "GeneratedFindingSubnetId1",
                                "LaunchedAt": "2016-08-02T02:05:06.000Z",
                                "IamInstanceProfileArn": "arn:aws:iam::111122223333:instance-profile/generated"
                            }
                        },
                        "Region": "ap-northeast-1",
                        "Id": "arn:aws:ec2:ap-northeast-1:111122223333:instance/i-99999999",
                        "Tags": {
                            "GeneratedFindingInstanceTag1": "GeneratedFindingInstanceValue1",
                            "GeneratedFindingInstanceTag2": "GeneratedFindingInstanceTagValue2",
                            "GeneratedFindingInstanceTag3": "GeneratedFindingInstanceTagValue3",
                            "GeneratedFindingInstanceTag4": "GeneratedFindingInstanceTagValue4",
                            "GeneratedFindingInstanceTag5": "GeneratedFindingInstanceTagValue5",
                            "GeneratedFindingInstanceTag6": "GeneratedFindingInstanceTagValue6",
                            "GeneratedFindingInstanceTag7": "GeneratedFindingInstanceTagValue7",
                            "GeneratedFindingInstanceTag8": "GeneratedFindingInstanceTagValue8",
                            "GeneratedFindingInstanceTag9": "GeneratedFindingInstanceTagValue9"
                        }
                    }
                ],
                "ProcessedAt": "2026-08-11T07:44:44.830Z"
            }
        ]
    }
}

これまでに作成したファイルを一覧出力すると下記の内容です。

$ ls -1
event-pattern-allow-dos-dns-sample.json
event-pattern-exclude-all-samples.json
test-event-01-real-cloudtrail-logging-disabled.json
test-event-02-sample-anomalous-behavior.json
test-event-03-sample-dos-dns.json
test-event-04-sample-c2-activity-b.json

test-event-pattern コマンドを用いて、全 8 パターンをテストします。

for pattern in event-pattern-exclude-all-samples event-pattern-allow-dos-dns-sample; do
  for event in test-event-01-real-cloudtrail-logging-disabled \
      test-event-02-sample-anomalous-behavior \
      test-event-03-sample-dos-dns \
      test-event-04-sample-c2-activity-b; do
    echo "=== pattern: ${pattern} / event: ${event} ==="
    aws events test-event-pattern \
      --event-pattern file://${pattern}.json \
      --event file://${event}.json
  done
done

実行結果です。

=== pattern: event-pattern-exclude-all-samples / event: test-event-01-real-cloudtrail-logging-disabled ===
{
    "Result": true
}
=== pattern: event-pattern-exclude-all-samples / event: test-event-02-sample-anomalous-behavior ===
{
    "Result": false
}
=== pattern: event-pattern-exclude-all-samples / event: test-event-03-sample-dos-dns ===
{
    "Result": false
}
=== pattern: event-pattern-exclude-all-samples / event: test-event-04-sample-c2-activity-b ===
{
    "Result": false
}
=== pattern: event-pattern-allow-dos-dns-sample / event: test-event-01-real-cloudtrail-logging-disabled ===
{
    "Result": true
}
=== pattern: event-pattern-allow-dos-dns-sample / event: test-event-02-sample-anomalous-behavior ===
{
    "Result": false
}
=== pattern: event-pattern-allow-dos-dns-sample / event: test-event-03-sample-dos-dns ===
{
    "Result": true
}
=== pattern: event-pattern-allow-dos-dns-sample / event: test-event-04-sample-c2-activity-b ===
{
    "Result": false
}

想定通りの動作になっていることを確認できました。

さいごに

AWS DevOps Agent で自動調査している環境で、マネジメントコンソールから一斉に GuardDuty のサンプルを発生させると、思わぬ課金につながる場合があります。

https://dev.classmethod.jp/articles/guardduty-sample-finding-devops-agent-billing-incident/

その対策として、Amazon GuardDuty の検出通知を AWS Security Hub CSPM で実施している環境において、EventBridge ルールのイベントパターンでサンプルの検出を除外する設定を試してみました。
以上、このブログがどなたかのご参考になれば幸いです。

この記事をシェアする

AWSのお困り事はクラスメソッドへ

関連記事

Microsoft Sentinel へ転送する AWS Security Hub CSPM の Findings を特定サービスのみに限定してみた
yhana
2026.07.04
新しくなった Security Hub の検出結果をフィルタして通知したい
ぐっさん
2026.02.11
Security Hub CSPM に集約した GuardDuty の検知を DevOps Agent で調査し Slack 通知までを試してみた
大村 保貴
2026.05.24
CCoEとしてマルチアカウント環境 GuardDuty 検知運用を AWS DevOps Agent で効率化しようとした話
川原征大
2026.07.28