GuardDuty or EDR on the host?

[landbaychrisburrell]

Hi

I was just wondering if it makes sense/is possible to run a GuardDuty host-level agent on BottleRocket OS? or for that matter, any other type of EDR - most of which seems either incompatible or hard to run (including GuardDuty?).

I'm surmising that the OS has been designed to mostly and only run containers, so then presumably running the guardduty or other EDR agents as pods is sufficient, given they all now seem to leverage ePBF for injection into runtime ops?

Cheers
Chris

[koooosh]

Thanks for the question, @landbaychrisburrell !

so then presumably running the guardduty or other EDR agents as pods is sufficient

Exactly, other Bottlerocket users have had success using the GuardDuty agent EKS add-on.

We also have an open feature request to add GuardDuty at host-level, if you’d like to add to that: #3679