Skip to main content
In this guide you’ll learn how to enable AWS GuardDuty, generate sample findings, and inspect resulting alerts in the AWS console. This walkthrough is optimized for clarity and quick reference, with practical tips for safe testing and investigation.

​
What is GuardDuty?

AWS GuardDuty is a managed threat detection service that continuously monitors for malicious or unauthorized behavior across your AWS accounts and workloads. When enabled, GuardDuty aggregates telemetry (API logs, VPC flow logs, DNS logs, etc.), applies threat intelligence and machine learning, and surfaces prioritized findings so you can quickly triage and remediate risk.
Enable GuardDuty in non-production accounts if you want to safely explore findings. You can also use GuardDuty’s sample findings feature to practice investigation without generating real attacks.

​
Enable GuardDuty

  1. Open the AWS Management Console and search for “GuardDuty” (typing “Guard” is sufficient).
  2. Click Get started and review required permissions and features.
  3. Select Enable GuardDuty to begin a free 30-day trial (if applicable) and start collecting findings.
Once enabled, GuardDuty presents a summary dashboard that prioritizes findings by severity (High, Medium, Low), highlights top threats, shows attack sequences, and lists resources/accounts with the most findings.
Screenshot of an AWS GuardDuty Summary console. The left column lists several critical findings (e.g., potential S3 and credential compromises) and the right shows a pie chart of threat categories.
The dashboard gives a quick overview of:
  • Counts (attack sequences, total findings, resource findings, account findings)
  • Visual breakdown of common finding types and categories
  • Prioritized list of high-severity findings for immediate triage
You can filter the dashboard by severity or resource type (for example, show only EC2-related findings to focus on compute compromises).
Screenshot of the AWS GuardDuty Summary page showing multiple critical findings on the left and a "Resources with most findings" list on the right with instance and cluster entries. The left column shows repeated "Potential EC2 instance group compromise" alerts marked Critical.
GuardDuty supports multi-account aggregation (via AWS Organizations) and timestamps each finding so you can track when suspicious activity first and last occurred.

​
Inspect Findings

Open the Findings list to see individual entries. Use built-in filters to narrow results by severity, resource type, finding ID, region, or other fields. Filters help you scope investigations or create suppression rules for noisy, low-value signals. Selecting a finding opens a detailed pane with:
  • First and last seen timestamps
  • A narrative describing observed activity and attack sequence
  • Signals used to generate the finding (API calls, network connections, referenced IPs)
  • Indicators of technique and actors involved (principal IDs, usernames, IP addresses)
  • Affected region, account, finding ID, and specific resource(s) such as an instance ID or access key
A screenshot of the AWS GuardDuty "Finding details" page showing an account-discovery/account-manipulation finding with a finding ID, region and account. It also shows details like a connected Tor exit node, sensitive API calls, and the principal ID/username.
Example signals you might see:
  • CreateRole requests from unusual IP ranges (e.g., Tor exit nodes)
  • AttachRolePolicy calls originating from compromised endpoints
  • DeleteTrail used to evade logging and detection
A screenshot of the AWS GuardDuty console showing a critical finding titled "Potential credential compromise of IAMUser/john_doe" with an Actions button. The page displays finding details and tabs for Signals and Resources, and the account/organization name in the header.

​
Generate Sample Findings (safe testing)

If you prefer not to perform real-world attacks in your environment, use GuardDuty’s Sample findings to populate the Findings list with representative alerts for UI exploration and playbooks. Steps:
  1. In GuardDuty, open Settings.
  2. Scroll to the Sample findings section.
  3. Click Generate sample findings and confirm.
GuardDuty will create sample findings across severities and categories. These populate the dashboard and Findings list so you can practice investigation, filtering, suppression rules, and export workflows.
A screenshot of the AWS GuardDuty console showing the "Findings" page with 434 findings and an open filter dropdown listing options like "Kubernetes API caller IPv4 address" and "Network connection." The page also shows buttons for "Create suppression rule" and "Actions."
Use filters such as “Kubernetes API caller IPv4 address” or “Network connection” to pinpoint specific telemetry sources. You can also:
  • Create suppression rules for known harmless noise
  • Export findings for SIEM ingestion or further analysis
  • Trigger automated remediation (via Lambda, Systems Manager, etc.)
Do not run offensive tests (actual attacks) in production. Use sample findings or dedicated test accounts to avoid accidental disruption and preserve audit trails.

​
Common Finding Types and Suggested Remediations

​
Summary / Key Takeaways

  • GuardDuty offers prioritized, account-wide threat detection and correlates telemetry into meaningful findings.
  • Use the dashboard for rapid triage and the Findings list for deep investigation.
  • Generate sample findings to practice safely.
  • Apply filters, suppression rules, and automated remediation as part of your incident response process (rotate keys, isolate instances, update IAM policies, etc.).
That covers enabling GuardDuty, creating sample findings, and inspecting alerts in the console.

Watch Video