GuardDuty

AWS GuardDuty is a managed threat detection service that continuously monitors your AWS environment for suspicious or malicious activity. It combines machine learning, anomaly detection, and threat intelligence to identify threats such as unauthorized access, compromised instances, and suspicious network traffic. When GuardDuty detects malicious or anomalous activity, it generates findings that help you investigate and respond quickly. GuardDuty analyzes telemetry from multiple AWS sources to detect threats and contextualize findings:

​

Data sources GuardDuty monitors

GuardDuty ingests these sources, enriches events with threat intelligence and ML-based models, and produces findings that include contextual metadata (resource identifiers, IPs, geolocation, etc.) to help prioritize and remediate incidents.

​

Severity and prioritization

Each GuardDuty finding includes a severity score so you can triage and prioritize responses. The numeric severity values are commonly grouped into three buckets: Use severity along with the finding type, affected resources, and supporting metadata to build targeted workflows that reduce false positives and surface true incidents faster.

​

Customizable lists (whitelists and blacklists)

GuardDuty supports custom lists to refine detection accuracy:

• Trusted IP list — a whitelist of IP addresses you consider safe. GuardDuty can ignore log activity from these IPs to reduce noise.
• Threat IP list — a blacklist of known malicious IPs from third parties or your security team. Observations of these IPs will generate findings.

​

Common detection categories and examples

• Reconnaissance
  • Examples: unusual API activity, network scanning for open ports, repeated failed logins, unauthorized port probing from known-malicious IPs.
• Instance compromise
  • Examples: unauthorized crypto-mining, command-and-control callbacks, malware evasion behavior, unusually high outbound traffic or unexpected network communications.
• Account compromise
  • Examples: API calls from anomalous geolocations or anonymizing proxies, attempts to disable CloudTrail, policy weakening, unexpected resource deployments or Region changes.
• Bucket compromise
  • Examples: suspicious S3 data access patterns that suggest credential misuse, remote access from unusual locations, or large/rapid data retrievals indicating possible exfiltration.

​

Integration and automation

GuardDuty findings can be routed to EventBridge (formerly CloudWatch Events) so you can automatically trigger actions such as:

• AWS Lambda functions for automated containment or remediation
• SNS notifications or Chime/Slack alerts to on-call teams
• SIEM or ticketing system integrations for incident management

Design your automation to use the finding severity and type so high-confidence/high-severity findings trigger immediate containment, while lower-severity findings follow a different review workflow. This reduces noise and prevents over-automation of false positives.

​

Best practices

• Enable GuardDuty across all accounts using AWS Organizations for centralized management.
• Turn on S3 data-plane events if you need visibility into object-level S3 access.
• Feed findings into EventBridge to create targeted rules that trigger Lambda runbooks, SNS notifications, or workflow tickets.
• Maintain and regularly review your Trusted IP and Threat IP lists to keep detections relevant.
• Combine GuardDuty findings with other AWS security services (AWS Config, CloudTrail, AWS Security Hub) for richer context and prioritized remediation.

​

Links and references

• GuardDuty documentation
• AWS CloudTrail
• VPC Flow Logs
• S3
• EKS audit logs
• RDS/Aurora
• EventBridge / CloudWatch Events
• AWS Lambda