Amazon GuardDuty
Amazon GuardDuty is a continuous threat-monitoring service of Amazon Web Services that monitors AWS accounts for security threats.
Key points
- Continuously monitors AWS accounts, identifying harmful or illegal activity. On enablement, GuardDuty automatically ingests foundational data sources — CloudTrail management events, VPC Flow Logs, and DNS (Domain Name System) query logs — using machine learning, anomaly detection, and threat intelligence feeds to produce findings. Extended sources such as S3 data events, EKS audit logs, RDS/Aurora login activity, and Lambda network activity are ingested only when the matching protection plan below is enabled.
- Provides automatic monitoring, without requiring manual review of logs or configuration, or deployment of additional software or agents.
- Optional protection plans extend detection to specific workloads: S3 Protection, EKS Protection, Malware Protection (scans EBS volumes and S3 objects on suspicious EC2/container workloads, plus AWS Backup data), RDS Protection (Aurora and RDS login activity), Lambda Protection (monitors Lambda network activity logs for serverless-specific threats), and Runtime Monitoring (OS-level activity across EC2, ECS-Fargate, and EKS). All protection plans except Runtime Monitoring are enabled by default during the 30-day free trial.
- Extended Threat Detection uses AI/ML to correlate multi-stage attack sequences across data sources and accounts. It is automatically enabled for every account at no additional cost and does not require any protection plan to be active, though enabling S3 Protection broadens the attack sequences it can identify.
- Findings can trigger automated remediation, and feed into Amazon Detective for root-cause investigation, or into AWS Security Hub (now named AWS Security Hub CSPM) for aggregation alongside other services such as Amazon Inspector.
- GuardDuty is a threat-detection service, not a vulnerability scanner (Amazon Inspector), and it does not discover or classify sensitive data (Amazon Macie).