Amazon GuardDuty

What it is

Amazon GuardDuty is a threat detection service that continuously monitors and analyzes AWS data sources and logs to find suspicious and malicious activity. It uses threat intelligence feeds (malicious IP (Internet Protocol)The protocol that addresses and routes packets between networks. Each device has an IP address: IPv4 addresses look like 192.0.2.1, and IPv6 addresses are longer, like 2001:db8::1.Glossary entry addresses, domains, and file hashes) and ML (Machine learning)Software that learns patterns from example data to make predictions or decisions, instead of following rules written by hand. A model is first trained on data, then used to make predictions on new data, which is called inference.Glossary entry to detect threats such as:

Compromised or exfiltrated AWS credentials.
Cryptomining on EC2 instances and containers.
Malware on instances, containers, and new S3 uploads.
Data exfiltration that can lead to ransomware.
Unusual login patterns on Aurora and RDS databases.
Communication with known malicious IPs and domains.

Choose GuardDuty when a question asks for intelligent threat detection across an account or organization with minimal setup, for example to detect compromised instances, unusual API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry calls, or reconnaissance.

Data sources and protection plans

Foundational data sources: when you enable GuardDuty, it automatically starts analyzing the following, and you don't need to enable anything else:
- CloudTrail management events.
- VPC Flow Logs (from EC2 instances).
- Route 53 Resolver DNS (Domain Name System)The internet's directory, which translates domain names such as example.com into IP addresses that computers use to connect. Amazon Route 53 is the AWS DNS service.Glossary entry query logs.
GuardDuty reads these independently, analyzes them, and then discards them.
Protection plans extend coverage:
- S3 Protection: data-plane activity on S3 objects.
- EKS Protection: Kubernetes audit logs.
- Runtime Monitoring: a GuardDuty security agent watches OS-level file, process, and network events on EKS, ECS on Fargate, and EC2.
- Malware Protection: for EC2, and for new objects uploaded to S3.
- RDS Protection: login activity on Aurora and RDS.
- Lambda Protection: network activity of Lambda functions.
Extended Threat Detection: automatically detects multi-stage attacks that span data sources, resource types, and time, and reports them as attack sequence findings.

Working with findings

Each finding describes the threat, the affected resource, and a severity.
Automate the response: GuardDuty sends findings to Amazon EventBridge, so a rule can notify a team through SNS or run a Lambda function, for example to isolate an instance.
Multi-account: with AWS Organizations, a delegated administrator account enables and manages GuardDuty for all member accounts.
Findings also flow into AWS Security Hub, and you can investigate them with Amazon Detective.

Security, resilience, performance, and cost

Security: no agents or extra logging needed for foundational detection, so there is no impact on workload performance; Runtime Monitoring adds an agent for deeper visibility.
Cost: a 30-day free trial when you first enable GuardDuty in a AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry, which shows an estimate of monthly usage. After that, charges depend on the data sources and protection plans you use.

GuardDuty or another option?

If the requirement is	Choose
Detect threats and compromised resources from logs	Amazon GuardDuty
Find software vulnerabilities in EC2, images, and Lambda	Amazon Inspector
Find sensitive data in S3	Amazon Macie
Investigate the root cause of a finding	Amazon Detective
One view of security posture and findings	AWS Security Hub
Record API calls for audit	AWS CloudTrail

Reverse mindmap: when the question points here

Is it Amazon GuardDuty?

Yes, when the question says
- Detect compromised EC2 instances or credentials leads to GuardDuty
- Cryptomining or calls to malicious IPs leads to GuardDuty
- Threat detection with no agents or log setup leads to GuardDuty foundational sources
- Unusual API activity from CloudTrail leads to GuardDuty
Extend it
- Malware in EC2 or new S3 objects leads to Malware Protection
- Suspicious S3 data access leads to S3 Protection
- Runtime threats in EKS, ECS, or EC2 leads to Runtime Monitoring agent
- Unusual database logins leads to RDS Protection
- Multi-stage attacks leads to Extended Threat Detection
Respond
- Isolate an instance automatically leads to EventBridge rule to Lambda
- All accounts in the organization leads to Delegated administrator
No, when the question says
- Unpatched software leads to Inspector
- Credit card numbers in S3 leads to Macie

Key takeaways

GuardDuty detects threats using threat intelligence and machine learning.
It analyzes CloudTrail management events, VPC Flow Logs, and DNS logs automatically, with nothing else to enable.
Protection plans add S3, EKS, Runtime Monitoring (agent), Malware Protection, RDS, and Lambda coverage; Extended Threat Detection finds multi-stage attacks.
Send findings to EventBridge for automated response; manage all accounts through Organizations.
There is a 30-day free trial.