Get AWS Guard Duty into Splunk

[manish_singh_77]

Hi All,

I am trying to get "AWS Guard Duty" data into Splunk. However, there is one app "https://splunkbase.splunk.com/app/3790/"  which has been archived. Is there any other app which we can use or any other method we can follow to get the AWS Guard Duty dat

[youngsuh]

Have you made progress on this?  Was it installing https://splunkbase.splunk.com/app/3719/ the solution?

I'd also found this:

https://www.splunk.com/en_us/blog/tips-and-tricks/serving-it-up-with-aws-and-splunk-aws-serverless-a...

[livehybrid]

Are you looking for something to get the data in to Splunk or more the data enrichment?

We're using a customised version of the app you mentioned, we took the props/transforms/lookups/tags etc from the app to build our own.

We're bringing data in through the method mentioned in the app, which is Cloudwatch events -> Firehose -> HEC and landing it as aws:cloudwatch:guardduty.