Threat Detection with Amazon GuardDuty - ML-Based Anomaly Detection and Incident Response
Learn how GuardDuty detects threats, classifies findings, and integrates with Security Hub for incident response.
Overview of GuardDuty
GuardDuty is a service that continuously detects threats to your AWS accounts and workloads, identifying over 200 threat patterns. It automatically analyzes CloudTrail events, VPC Flow Logs, and DNS query logs to detect unauthorized API calls, cryptocurrency mining, communication with C&C servers, brute-force attacks, and more. Enabling it takes a single click, with no changes required to your existing log configurations.
Findings and Response
Findings are classified into types such as Recon (reconnaissance), UnauthorizedAccess, CryptoCurrency (mining), and Trojan. High-severity findings require immediate action. You can use EventBridge rules to trigger Lambda functions that automatically revoke compromised IAM credentials or isolate EC2 instances. By integrating with Security Hub, you can consolidate GuardDuty findings with results from other security services and manage your security posture from a single pane of glass.
Protection Plans and Organizations Integration
In addition to basic threat detection, GuardDuty offers protection plans including S3 Protection (analysis of S3 data events), EKS Protection (analysis of Kubernetes audit logs), Malware Protection (malware scanning for EC2 and ECS), RDS Protection (analysis of RDS login activity), Lambda Protection (analysis of Lambda network activity), and Runtime Monitoring (runtime threat detection for EC2/ECS/EKS). Using the Organizations delegated administrator, you can centrally manage GuardDuty across all accounts and configure automatic enablement for new accounts. Findings are automatically aggregated in Security Hub. For a systematic study of GuardDuty, related books on Amazon can be a helpful resource.
Optimizing GuardDuty Costs
GuardDuty's base pricing is based on the volume of CloudTrail management events and VPC Flow Logs analyzed. CloudTrail events cost approximately $4 per million events, and VPC Flow Logs cost approximately $1 per GB. Each protection plan incurs additional charges; for example, S3 Protection costs approximately $0.80 per million S3 data events. Use the 30-day free trial to assess actual costs before enabling the service. Malware Protection is charged based on the volume of data scanned, so limit scan targets to critical workloads to manage costs.
Summary
GuardDuty is a service that automatically detects threats in your AWS environment using ML and threat intelligence. Its protection plans for S3, EKS, Lambda, RDS, and Runtime Monitoring provide multi-layered threat detection, while Organizations integration enables centralized security management across all accounts. By building automated remediation actions through EventBridge integration, you can automate your security operations.