Amazon GuardDuty

Amazon GuardDuty is an intelligent threat detection service that continuously monitors AWS accounts, workloads, and data for malicious activity and unauthorized behavior. It uses machine learning, anomaly detection, and AWS threat intelligence to analyze multiple data sources — with no additional infrastructure or agents to deploy.

Objectives

• Continuously monitor AWS environments for security threats.
• Detect malicious and unauthorized activities.
• Identify compromised AWS resources.
• Reduce the time required to detect security incidents.
• Improve the organization's overall security posture.
• Integrate with centralized security monitoring and incident response.

Architecture

Data sources

Source	What it monitors
AWS CloudTrail	API calls, authentication events, IAM activity, management operations.
Amazon VPC Flow Logs	Network traffic, unexpected inbound/outbound, port scanning.
Amazon Route 53 DNS Logs	Communication with malicious domains, suspicious queries, C2 activity.
Amazon EKS Audit Logs	Kubernetes API activity, unauthorized access, privilege escalation.

Threat detection flow

1. AWS services generate logs and events.
2. GuardDuty continuously analyzes these data sources.
3. Machine learning models and AWS threat intelligence identify suspicious behavior.
4. GuardDuty generates security findings with severity levels.
5. Findings are sent to Security Hub, EventBridge, CloudWatch, or SNS for alerting.
6. Security teams investigate and remediate identified threats.

Example threats detected

• Compromised EC2 instances
• Unauthorized API calls
• Stolen or compromised AWS credentials
• Cryptocurrency mining activity
• Malware communication
• Port scanning and brute-force login attempts
• Suspicious network traffic and data exfiltration attempts
• Access from known malicious IP addresses