On this page
On this page
- What Is GuardDuty
- How GuardDuty Works
- Finding Types
- Controlling What GuardDuty Flags
- Trusted IP Lists
- Threat Intelligence Lists
- Suppression Rules
- Multi-Account Setup with AWS Organizations
- Automated Remediation with EventBridge
- EBS Malware Scanning
- GuardDuty vs Other Security Services
- Operational Notes
- Key Exam Scenarios
- CloudWatch Integration
- Automatically Published
- Requires Setup
GuardDuty
GuardDuty is AWS's threat detection service. It continuously analyzes activity in your AWS account — API calls, network traffic, and DNS queries — and uses machine learning and threat intelligence to identify malicious or unauthorized behavior, then alerts you.
What It Watches
GuardDuty ingests three data sources automatically without any infrastructure to set up:
CloudTrail logs — GuardDuty watches for suspicious API patterns: an IAM
user calling GetSecretValue from a Tor exit node, a root account making API
calls (a red flag), or a sudden spike in EC2 instance launches that could
indicate a crypto-miner spinning up resources on your bill.
VPC Flow Logs — network traffic data that shows which IPs are communicating with your instances. GuardDuty flags communication with known malicious IPs, unusual outbound traffic (data exfiltration), and port scanning behavior.
DNS logs — queries made by your EC2 instances. Malware often communicates with command-and-control servers via DNS. GuardDuty detects queries to known malicious domains.
What GuardDuty Is Not
GuardDuty is a detection tool, not a prevention tool. It watches, analyzes, and alerts. It does not block traffic, change security groups, or take action by itself. You provide the response — either manually or by wiring GuardDuty findings to EventBridge and triggering automated remediation via Lambda.
Findings
When GuardDuty detects a threat, it creates a finding with a severity rating (LOW, MEDIUM, HIGH, CRITICAL) and a detailed description of what was detected, which resource is affected, and what the likely impact is. Examples:
UnauthorizedAccess:EC2/TorClient— an EC2 instance is communicating via TorCryptoCurrency:EC2/BitcoinTool.B— an EC2 instance is mining cryptocurrencyStealth:IAMUser/PasswordPolicyChange— the account password policy was weakened
Multi-Account Coverage
In an AWS Organizations setup, GuardDuty can be centrally managed from a delegated administrator account. The security team sees findings from every member account in a single console, and member accounts cannot disable the service without the administrator's approval.