Connecting Amazon GuardDuty or Microsoft Defender for Cloud

GuardDuty and Defender for Cloud are both cloud-provider-native security alerting services — a finding from either one is already pre-triaged by the vendor, unlike a raw log line. Connecting either one here gives Qorionix read access to that vendor's findings and starts the automatic poll.

Amazon GuardDuty

1. 1

   Create a read-only IAM identity

   In AWS IAM, create a user or role with the AWS managed policy AmazonGuardDutyReadOnlyAccess (or a policy scoped to guardduty:ListDetectors, guardduty:ListFindings and guardduty:GetFindings). Create an access key.

2. 2

   Note the region

   GuardDuty is regional. Set the AWS region your GuardDuty detector runs in. If you use temporary (STS) credentials from an assumed role, a session token is also required.

3. 3

   Connect it in Qorionix

   Under Integrations → Catalog → Amazon GuardDuty, choose Cloud security alerts, enter the access key, secret and region, and press Test and save.

GuardDuty findings are grouped into three severity bands by Qorionix — low, medium, high — matching GuardDuty's own documented 1.0–8.9 severity range, which has no fourth "critical" band. Only findings GuardDuty has not archived as resolved are considered.

Microsoft Defender for Cloud

This is a separate connector and a separate app registration from Microsoft Defender for Business (Defender for Endpoint). Defender for Cloud authenticates against Azure Resource Manager for subscription-level cloud posture alerts, not against Microsoft Graph or the Defender for Endpoint API — a different permission scope entirely, so the two integrations are not interchangeable and do not share credentials.

1. 1

   Register an app and grant it Reader

   In the Entra admin center, register an application. Grant it the Reader role (or a role that includes Microsoft.Security/alerts/read) on the Azure subscription whose alerts you want to read.

2. 2

   Create a client secret

   Under Certificates & secrets, create a new secret and copy its value immediately.

3. 3

   Connect it in Qorionix

   Under Integrations → Catalog → Microsoft Defender for Cloud, choose Cloud security alerts, enter the tenant ID, client ID and secret, and press Test and save.

Defender for Cloud's "Informational" severity band is folded into "low" in Qorionix, matching the same three-band floor GuardDuty uses.

What you see once it is polling

• A new finding from either source appears as an incident in the same queue as everything else, tagged with its source connector.
• The AWS account id (GuardDuty) or the Azure subscription id (Defender for Cloud) is recorded as the account entity on the incident, and the affected resource as the host entity.
• A finding GuardDuty has archived as resolved is not imported; only currently-open findings are polled.