Looking for Testers and Contributors: AWS GuardDuty to Microsoft Sentinel Integration

Femitek Consulting — Wed, 22 Jul 2026 21:06:33 +0000

I recently published guardduty-sentinel-integration, an open-source project that helps security teams ingest, structure and investigate AWS GuardDuty findings in Microsoft Sentinel.

Repository: github.com/OluOlus/guardduty-sentinel-integration

The project was built to address a practical problem: GuardDuty generates useful security findings, but getting those findings into Sentinel in a structured and investigation-ready format can require several separate configuration, parsing and normalisation steps.

This repository brings those steps together in one implementation.

What the project includes

The repository provides two ingestion options:

Managed ingestion: GuardDuty → S3 → SQS → Microsoft Sentinel AWS connector
Near-real-time ingestion: GuardDuty → EventBridge → Lambda → Log Analytics API

It also includes:

KQL parsing functions
ASIM-aligned network-session normalisation
High-severity investigation queries
IAM, S3, EKS and network-threat queries
Sample GuardDuty findings
Deployment scripts
Validation and troubleshooting guidance
A Lambda handler that transforms GuardDuty findings into a Sentinel-friendly schema

I am looking for testers

I would like feedback from cloud-security engineers, SOC analysts, Sentinel users and AWS practitioners who can test the project in a lab or non-production environment.

Useful testing areas include:

GuardDuty finding ingestion
EventBridge and Lambda delivery
S3 and SQS connector configuration
Field parsing and severity mapping
ASIM normalisation
KQL query accuracy
Duplicate or failed-record handling
Delivery latency
IAM and permission requirements
Documentation clarity

When reporting a problem, please include:

the ingestion path used;
the type of GuardDuty finding;
the expected result;
the actual result;
relevant logs or error messages, with sensitive information removed.

Contributions are welcome

Possible contribution areas include:

additional KQL hunting queries;
Sentinel analytics rules;
workbooks and dashboards;
improved ASIM mappings;
support for more GuardDuty finding types;
automated testing;
CI validation;
deployment improvements;
documentation fixes;
troubleshooting examples;
security and code review.

You can contribute by:

Forking the repository.
Creating a branch for your change.
Opening an issue to discuss larger changes.
Submitting a pull request with a clear explanation of the problem and solution.

Suggested first contributions

Some useful starting points are:

test the sample findings against the KQL functions;
review the ASIM field mappings;
add a query for another GuardDuty finding category;
improve the deployment documentation;
create a Sentinel workbook for GuardDuty findings;
test the integration in a fresh AWS and Sentinel environment.

The goal is to make the repository a practical, reusable reference for teams operating across AWS and Microsoft security environments.

Feedback, issues, test results and pull requests are welcome.