AWS Guardduty & Splunk

[aknsun]

Hi,

I have a requirement to get the AWS Guardduty working with Splunk. However I'm slightly confused on which method to pursue.

• The pull approach which involves configuring services like Amazon Simple Notification Service (SNS) and Amazon Simple Queue Service (SQS) with a dead letter queue and installing and setting up the Splunk Add-on application that polls for the messages in an SQS queue.

OR

• The push approach that uses Amazon CloudWatch events and Amazon Kinesis Data Firehose with the Splunk HEC

Hope someone can highlight the pros & cons of each approach.

Thanks,
AKN

[amiracle · Accepted solution]

I've put together a document that might be able to help guide you on your decision between Push vs, Pull options, specific to AWS data sources . To quickly answer the question, it's going to depend on scale, cost, maintenance and latency of the data. If you're collecting from one account and it's relatively small amounts of data, then going the pull path would make sense. However, if you have multiple accounts collection large amounts of data, it might make sense to go down the path of Kinesis Firehose.

If you decide to go down the push path, I would recommend you look at the Project Trumpet blog for collecting that data (and help setting up the AWS components as well.)

(Edit Added the AWS GDI Doc/Whitepaper link.)

[aknsun]

@amiracle Thanks for the suggestions.