Proposal: ASIM-aligned AWS GuardDuty parser and hunting queries

[OluOlus]

I have developed and validated an ASIM-aligned parsing layer for AWS GuardDuty findings ingested through the existing Microsoft Sentinel AWS connector. The proposed contribution would extend the current AWS solution with:

• an ASIM Network Session parser (ASimNetworkSessionAWSGuardDuty)
• hunting queries for high-severity findings, EKS privilege escalation/credential access, and S3 public exposure
• validation against the existing AWSGuardDuty table schema and the current AWS S3 connector

This proposal does not replace the existing AWS connector or the existing AWSGuardDuty - GuardDuty Alert analytic rule. It adds structured ASIM parsing and hunting content on top of the existing AWSGuardDuty table. I'd welcome guidance on whether this should be folded into the existing Amazon Web Services solution or submitted as standalone content.

[v-utpalkumar]

Hello OluOlus,

I’m sharing a few points about the current contribution workflow for the Content Hub and the Solutions/Standalone architecture to help ensure that you submit your PR correctly. I’m also sharing the README link, where you can find additional information, including the Contribution guidelines.

README Link: https://github.com/Azure/Azure-Sentinel/blob/70d13ec638f559d8347efa93258bbc1018d53cfb/README.md#microsoft-sentinel-and-microsoft-365-defender

• Are standalone rule contributions still desired? Is Microsoft still accepting individual detection rules and hunting queries from the community, or are you moving toward exclusively accepting contributions that are packaged into full "Solutions"? :- If there is a single Detection rule or Hunting query, it can be contributed as a standalone item. However, if there are multiple Detection rules or Hunting queries along with other components, it is recommended to bundle them and publish them as a Solution.

• Repository Placement: If we write a new detection rule or hunting query for an existing data source (e.g., AWS, Windows Security Events), should we place it in the top-level Detections/ or Hunting Queries/ folders, or must it be placed inside the respective Solutions// folder? :- If the Detection rules or Hunting queries rely on an existing data source or are associated with one, it is advisable to include the Detection rules or Hunting queries in the same existing bundle and publish everything as a Solution.

• Visibility in Sentinel: If a community member successfully merges a rule, does it surface for end-users today, if so, where exactly? Does it automatically get bundled into a specific Content Hub solution package, or does it show up directly as a standalone item in the Sentinel Analytics/Hunting Template library? :- It depends on the contribution process. If the query/rule is contributed as a standalone item within the query or Detection folder, it becomes available once the PR has been tested, reviewed, and merged.
  However, if it is part of a Solution, any updates require solution packaging, testing, and PR creation. After the PR is reviewed and merged, the latest version goes through the publishing process and is typically made available in the Content Hub within 4–6 business days.

I hope my responses have addressed your queries. Thank you for your contribution!