I recently published guardduty-sentinel-integration, an open-source project that helps security teams ingest, structure and investigate AWS GuardDuty findings in Microsoft Sentinel.
Repository: github.com/OluOlus/guardduty-sentinel-integration
The project was built to address a practical problem: GuardDuty generates useful security findings, but getting those findings into Sentinel in a structured and investigation-ready format can require several separate configuration, parsing and normalisation steps.
This repository brings those steps together in one implementation.
What the project includes
The repository provides two ingestion options:
- Managed ingestion: GuardDuty → S3 → SQS → Microsoft Sentinel AWS connector
- Near-real-time ingestion: GuardDuty → EventBridge → Lambda → Log Analytics API
It also includes:
- KQL parsing functions
- ASIM-aligned network-session normalisation
- High-severity investigation queries
- IAM, S3, EKS and network-threat queries
- Sample GuardDuty findings
- Deployment scripts
- Validation and troubleshooting guidance
- A Lambda handler that transforms GuardDuty findings into a Sentinel-friendly schema
I am looking for testers
I would like feedback from cloud-security engineers, SOC analysts, Sentinel users and AWS practitioners who can test the project in a lab or non-production environment.
Useful testing areas include:
- GuardDuty finding ingestion
- EventBridge and Lambda delivery
- S3 and SQS connector configuration
- Field parsing and severity mapping
- ASIM normalisation
- KQL query accuracy
- Duplicate or failed-record handling
- Delivery latency
- IAM and permission requirements
- Documentation clarity
When reporting a problem, please include:
- the ingestion path used;
- the type of GuardDuty finding;
- the expected result;
- the actual result;
- relevant logs or error messages, with sensitive information removed.
Contributions are welcome
Possible contribution areas include:
- additional KQL hunting queries;
- Sentinel analytics rules;
- workbooks and dashboards;
- improved ASIM mappings;
- support for more GuardDuty finding types;
- automated testing;
- CI validation;
- deployment improvements;
- documentation fixes;
- troubleshooting examples;
- security and code review.
You can contribute by:
- Forking the repository.
- Creating a branch for your change.
- Opening an issue to discuss larger changes.
- Submitting a pull request with a clear explanation of the problem and solution.
Suggested first contributions
Some useful starting points are:
- test the sample findings against the KQL functions;
- review the ASIM field mappings;
- add a query for another GuardDuty finding category;
- improve the deployment documentation;
- create a Sentinel workbook for GuardDuty findings;
- test the integration in a fresh AWS and Sentinel environment.
The goal is to make the repository a practical, reusable reference for teams operating across AWS and Microsoft security environments.
Feedback, issues, test results and pull requests are welcome.
Top comments (0)