Amazon GuardDuty
A managed threat detection service that uses machine learning and threat intelligence to continuously monitor and detect threats across AWS accounts and workloads
Overview
Amazon GuardDuty is an intelligent threat detection service that continuously monitors and detects malicious activity and anomalous behavior across your AWS accounts, workloads, and data. It automatically analyzes data sources such as VPC Flow Logs, CloudTrail event logs, DNS logs, S3 data events, EKS audit logs, and Lambda network activity logs, using machine learning, anomaly detection, and integrated threat intelligence to identify threats. It detects a wide range of threat patterns including unauthorized API calls, cryptocurrency mining, communication with command-and-control servers, brute-force attacks, and suspicious S3 bucket access. Findings are classified by severity (High, Medium, Low) and can trigger automated remediation actions through EventBridge integration. Enabling GuardDuty takes a single click and requires no changes to your existing infrastructure.
Finding Type Classification and Reading Severity Levels
GuardDuty generates over 100 finding types, broadly categorized into four groups. Recon findings detect pre-attack reconnaissance activities such as port scanning and API enumeration. UnauthorizedAccess findings detect console logins from unusual locations and anomalous API call patterns. Trojan findings detect EC2 instances communicating with command-and-control servers or showing signs of cryptocurrency mining. Exfiltration findings detect signs of data theft, such as large-scale data downloads from S3 buckets. Each finding is assigned a severity level - High (7.0-8.9), Medium (4.0-6.9), or Low (1.0-3.9) - based on the potential impact. High-severity findings such as cryptocurrency mining or access from known malicious IPs demand immediate investigation, while Low-severity findings like unusual API calls may indicate misconfiguration rather than an active threat. Understanding these severity bands helps teams prioritize their response efforts effectively.
Automated Remediation via EventBridge Integration
The recommended approach for responding to GuardDuty findings is to use EventBridge rules that trigger Lambda functions for automated remediation. For High-severity findings, Lambda can automatically isolate compromised EC2 instances by modifying security groups, disable unauthorized IAM access keys, and send notifications to Slack or PagerDuty via SNS. A typical EventBridge rule filters on detail-type GuardDuty Finding and routes based on severity, so Critical actions execute immediately while Medium-severity findings create tickets for manual review. For a systematic study of threat detection and response, related books (Amazon) are also a useful reference. Enabling Malware Protection adds automatic EBS volume scanning when malware indicators are detected on EC2 instances or ECS containers, extending GuardDuty's detection beyond network-level threats.
Multi-Account Environments and Additional Protection Features
In multi-account environments, GuardDuty integrates with AWS Organizations to enable centralized management of findings across all member accounts from a dedicated security account. The delegated administrator account can enable GuardDuty automatically for new accounts as they join the organization, ensuring consistent coverage without manual setup. Beyond the core threat detection capabilities, GuardDuty offers additional protection features that can be enabled independently: S3 Protection monitors data plane events for suspicious bucket access patterns, EKS Protection analyzes Kubernetes audit logs for container-level threats, and Runtime Monitoring deploys a lightweight agent to detect host-level and container-level threats in real time. While Microsoft Defender for Cloud offers a broader security posture management suite, GuardDuty's strength lies in its deep integration with AWS-native data sources like VPC Flow Logs, CloudTrail, and DNS logs, delivering highly accurate threat detection tailored specifically to AWS environments. On pricing, GuardDuty uses volume-based billing at approximately $4.72 per million CloudTrail events and $1.18 per GB of VPC Flow Logs analyzed.