Amazon GuardDuty mindmap

Amazon GuardDuty

Threat detection service that continuously monitors AWS accounts, workloads and data for malicious activity and delivers detailed findings

• Internal AWS sources: Data GuardDuty reads directly from AWS services; you don't have to turn on the logs yourself
  • CloudTrail management events: Control plane API activity, such as IAM and EC2 calls. Foundational, on by default
  • CloudTrail S3 data events: Object-level API activity. Turned on by S3 Protection
  • VPC Flow Logs: Network traffic of EC2 instances. Foundational, on by default
  • DNS logs: Queries through the Route 53 Resolver. Foundational, on by default
  • Kubernetes audit logs: EKS control plane activity. Turned on by EKS Protection
  • Runtime activity: File, process and network events from a security agent on EKS, ECS on Fargate and EC2. Turned on by Runtime Monitoring
  • RDS login activity: Logins to Aurora and RDS databases. Turned on by RDS Protection
  • Lambda network activity: Network traffic from Lambda functions. Turned on by Lambda Protection
  • AI workload activity: CloudTrail data events from Bedrock, Bedrock AgentCore and SageMaker AI. Turned on by AI Protection
• Malware Protection: Scans for malware without agents
  • EC2 and EBS volumes: Scans EBS volumes when suspicious behavior is found, or on demand
  • New S3 objects: Scans objects as they are uploaded to the buckets you choose
  • AWS Backup: Scans backups before you restore them
• Threat intelligence (IP and domains): Lists of known malicious IP addresses and domains
  • AWS threat intelligence: Feeds curated by AWS security that GuardDuty uses automatically
  • Custom threat lists: Your own lists of malicious IP addresses, domains or file hashes
  • Trusted IP lists: Addresses you trust, so they generate no findings
• Anomaly detection and machine learning: Learns the normal behavior of each account and flags what departs from it
  • Extended Threat Detection: Correlates signals over time into multi-stage attack sequence findings, rated Critical
  • Behavior baselines: Unusual API calls, locations and network patterns
• Findings: Detailed security alerts about potential threats
  • Finding types: Named ThreatPurpose:ResourceType/ThreatFamilyName
    • EC2 findings
    • IAM findings
    • S3 findings
    • Kubernetes findings
    • Runtime Monitoring findings
  • Severity levels: Low, Medium, High and Critical
  • Managing findings
    • Filtering findings: Saved filters on finding attributes
    • Suppression rules: Archive expected findings automatically
    • Exporting findings: Send findings to an S3 bucket, encrypted with KMS
• Automated response and remediation: Act on findings as they arrive
  • Amazon EventBridge: Route findings to Lambda, Step Functions, SNS or ticketing
  • AWS Security Hub: See GuardDuty findings with your other security findings
• Pivot to Amazon Detective: Triage, scope and respond: investigate a finding with behavior graphs
• Multi-account management: A delegated administrator turns GuardDuty on and manages it for every member account
  • Auto-enable: New member accounts get GuardDuty and chosen protection plans automatically
  • Regional service: Turn it on in every Region you use
  • 30-day free trial: Per account and Region for foundational sources and most protection plans