Amazon GuardDuty
- What it is
- Intelligent threat detection service. Continuously analyzes logs for malicious or unauthorized behavior.
- Uses machine learning, anomaly detection, and threat intelligence feeds.
- What it reads
- VPC Flow Logs, AWS CloudTrail event and management logs, DNS query logs, EKS audit logs, S3 data events, RDS login activity, Lambda network activity.
- Agentless — no software to install, enable with one click.
- What it finds
- Cryptocurrency mining, compromised credentials, communication with known-bad IPs, unusual API calls, data exfiltration patterns.
- Not to be confused with
- Amazon Inspector — scans for vulnerabilities and misconfigurations in your workloads (a weakness that could be exploited). GuardDuty detects active threats (something bad happening now).
- Amazon Detective — takes a GuardDuty finding and helps you investigate the root cause.
- AWS Security Hub — aggregates findings from all of these into one dashboard.