Threat Detection with Amazon GuardDuty - ML-Based Anomaly Detection and Incident Response
Learn how GuardDuty detects threats, classifies findings, and integrates with Security Hub for incident response.
Overview of GuardDuty
GuardDuty is a service that continuously detects threats to your AWS accounts and workloads. It automatically analyzes CloudTrail events, VPC Flow Logs, and DNS query logs to detect unauthorized API calls, cryptocurrency mining, communication with C&C servers, brute-force attacks, and more. After you enable it, analysis starts without enabling anything else, and no changes are required to your existing log configurations. GuardDuty independently acquires log data, so users do not need to have VPC Flow Logs or CloudTrail manually enabled. The detection engine combines two approaches: AWS-managed threat intelligence feeds (known malicious IP addresses and domain lists) and account-specific behavioral baseline ML models.
Findings and Response
Findings are classified into types such as Recon (reconnaissance), UnauthorizedAccess, CryptoCurrency (mining), and Trojan. For High-severity findings, you can use EventBridge rules to trigger Lambda functions that automatically revoke compromised IAM credentials or isolate EC2 instances. By integrating with Security Hub, you can review GuardDuty findings together with results from other security services. A practical automated remediation architecture involves: GuardDuty generates a High severity UnauthorizedAccess:IAMUser finding -> EventBridge -> Lambda disables the access keys for the affected IAM user and requests an MFA reset ->SNS notifies the operations team.
Protection Plans and Organizations Integration
GuardDuty protection plans include S3 Protection, EKS Protection, Runtime Monitoring (runtime threat detection for Amazon EKS, Amazon EC2, and Amazon ECS including AWS Fargate), Malware Protection for EC2 (scanning of the EBS volumes associated with EC2 instances), Malware Protection for S3, RDS Protection, Lambda Protection, and others. Using the Organizations delegated administrator, you can manage GuardDuty across multiple accounts together and configure automatic enablement for new accounts. Findings can be sent to Security Hub for aggregation. Runtime Monitoring deploys a GuardDuty agent on hosts or containers to monitor file access, process execution, and network connections at the kernel level. This can be used to detect runtime threats such as process injection and reverse shells.
Optimizing GuardDuty Costs
Pricing for GuardDuty's basic threat detection depends on the volume of events and logs analyzed. Each protection plan incurs separate charges for the portion you enable. When you enable GuardDuty for the first time, protection plans other than Runtime Monitoring are also included in the 30-day free trial, so check costs during that period. Malware Protection is charged based on the volume of data scanned, so limit scan targets to critical workloads to manage costs. If costs are higher than expected after enabling, check the Usage page in the GuardDuty console for per-data-source cost breakdowns, disable unnecessary protection plans, or review access patterns for S3 buckets with high event frequency.
Detection Accuracy Tuning and False Positive Management
Immediately after enabling GuardDuty, false positives can occur, so adjust detection settings to stabilize operations. Registering your corporate global IPs and VPN exit IPs in Trusted IP Lists automatically suppresses findings generated from these addresses. Similarly, you can add custom threat intelligence to Threat IP Lists to enhance detection accuracy. Repetitive findings for specific resources can be hidden using Suppression Rules, but setting overly broad rules risks missing real threats, so set conditions narrowly, such as specific account ID + specific resource ARN + specific finding type. Integrating findings with Amazon Detective allows GuardDuty to show "what happened" while Detective visualizes "why and how" through IP address behavioral history and API call timelines, which can be used for investigation and false positive determination.
Role Differentiation with Other Security Services
AWS security services differ in detection targets and purposes, so you can build defense in depth by combining multiple services around GuardDuty. GuardDuty's primary purpose is continuous detection of anomalies in account behavior and network communications. For post-incident investigation use Amazon Detective, for vulnerability scanning use Amazon Inspector, and for IAM policy misconfiguration use IAM Access Analyzer. Security Hub serves as the central hub aggregating findings from all these services and provides compliance checks based on standards like AWS Foundational Security Best Practices. In a phased approach, you enable GuardDuty first, review its findings, and then add Detective or Inspector while checking costs. In multi-account environments, you can designate a security account as the delegated administrator and aggregate GuardDuty findings from all member accounts into this account.
Summary
GuardDuty is a service that automatically detects threats in your AWS environment using ML and threat intelligence. Its protection plans for S3, EKS, Lambda, RDS, and Runtime Monitoring extend detection coverage, while Organizations integration lets you manage GuardDuty across multiple accounts together. Through EventBridge integration, remediation actions for findings can run automatically. Trusted IP Lists and Suppression Rules reduce false positives, and Detective integration supports investigations.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
- Amazon GuardDuty official page
- AWS Security Hub official page
- Amazon Detective official page
- AWS Documentation (official)
If this page and the official documentation disagree, treat the official documentation as authoritative.