AWS Targeted Deployment Explorer

The AWS Targeted Deployment Explorer report displays the Amazon GuardDuty and Network IDS incident distribution by a selected AWS account ID, region, VPC, container image name, Security Group, or subnet target type.

For more information about incidents, see Incidents.

You must integrate Amazon GuardDuty for associated incidents to be displayed in Alert Logic console. For more information, see Integrate Amazon GuardDuty Findings into Alert Logic Incidents.

To access the AWS Targeted Deployment Explorer report:

  1. In the Alert Logic console, click the menu icon (), and then click Validate.
  2. Click Reports, and then click Threats.
  3. Under AWS Incident Analysis, click VIEW.
  4. Click AWS Targeted Deployment Explorer.

Filter the report

To refine your findings, you can filter your report by Select Target Type, Date Range, Customer Account, Detection Source, Deployment Name, AWS Account ID, Region, VPC, Container Image Name, Subnet, Top Tags, Threat Level, Classification, Incident Type,and Security Group.

Filter the report using drop-down menus

By default, Alert Logic includes (All) values for most filters in the report.

To add or remove filter values:

  1. Click the drop-down menu in the filter, and then select or clear values.
  2. Click Apply.

Filter the report using visuals

To refine your findings, click an item within a visual. To filter by multiple items, hold down Ctrl or Command, and then click each item in a visual that you want to use to apply a filter. You can filter using visuals and items selected in different sections. Click on an item again to remove a filter.

Schedule the report

After you finish setting up the report, you can use CREATE REPORT to run it periodically and subscribe users or an integration (such as a webhook) to receive a notification when the report is generated. To learn how to schedule the report and subscribe notification recipients, see Scheduled Reports and Notifications.

Incident Distribution by AWS Account ID for Selected Period section

This section displays the daily incident distribution for the selected target type in the selected date range.

Targeted Deployment Explorer Selected Top Targets section

This section lists detailed information about incidents selected using the Filter the report using visuals feature in the Incident Distribution by Target Type for Selected Period section.