AWS GuardDuty

Amazon GuardDuty is a continuous threat detection service that monitors your AWS accounts, workloads, and data for malicious activity, unauthorized access, and anomalous behavior.

Unlike firewall or assessment tools, GuardDuty is passive and non-intrusive. It uses machine learning, anomaly detection, and integrated threat intelligence to analyze background infrastructure log streams. It functions like an automated security guard, working entirely out-of-band without degrading the network throughput or computing performance of your live applications.

1. Foundational Data Sources

When GuardDuty is activated, it instantly and independently analyzes three primary stream arrays directly from the AWS global network layer, without requiring you to turn on local logging options:

• AWS CloudTrail Management Events: Tracks account-level actions and infrastructure changes. GuardDuty inspects these to catch credential compromise signatures, such as API requests originating from unusual geographic coordinates, attempts to alter strict password configurations, or unauthorized deletions of security logging files.

• VPC Flow Logs: Monitors the network traffic patterns flowing into and out of your Virtual Private Cloud network interfaces. GuardDuty parses this data to map connection velocities and catch infrastructure anomalies, such as an internal server attempting to launch an outbound denial-of-service attack or transferring unusually massive blocks of outbound data.

• Route 53 DNS Query Logs: Examines the domain lookup requests made by applications inside your private networks. GuardDuty scans these requests to identify internal hosts trying to connect out to known command-and-control (C2) servers or executing background malware queries.

  
  

2. Advanced Protection Capabilities (Extended Features)

Beyond parsing core network logs, GuardDuty includes specialized, optional feature modules to provide coverage across specific application and storage layers:

Runtime Monitoring

Provides deep, operating-system-level visibility inside virtual machines and managed container fleets (including Amazon EC2, Amazon EKS, and Amazon ECS with AWS Fargate). By executing lightweight, automated system agents, it tracks process executions, internal file changes, and raw socket connections to catch privilege escalations, shell injections, or active defense evasion tactics.

Malware Protection

• For EC2 Workloads: If GuardDuty detects an instance communicating with a known malicious endpoint, it can automatically trigger an agentless malware scan. It takes a temporary snapshot of the underlying Amazon EBS block storage volume, replicates it out-of-band, and scans it using a specialized file analysis engine to locate trojans, rootkits, or hidden cryptomining scripts. It never installs resource-heavy antivirus software directly onto your live production server.

  AWS - Amazon.com+ 2

• For S3 Storage: Automatically scans newly uploaded objects into designated S3 buckets to identify and block the distribution of malicious payloads before they can be downloaded by downstream client applications.

S3 Data Event Protection

Extends standard log analysis to inspect object-level CloudTrail data events (such as GetObject, PutObject, and ListBuckets). This allows the service to construct an operational profile of normal data consumption and instantly flag anomalies—such as a user account suddenly pulling down thousands of objects from a bucket they have never accessed before.

RDS Protection

Profiles database access trends by monitoring login behaviors against your Amazon Aurora database clusters. It uses anomaly detection to flag brute-force login attempts, credential stuffing, or structural access requests originating from unexpected geographic locations or untrusted proxy networks.

3. Findings and Response Orchestration

When GuardDuty isolates an anomaly, it does not output a simple log text; it generates a structured JSON object called a Finding.

Severity Categorization

Each finding is automatically labeled with a severity score to help security teams prioritize triage workflows:

• Low (0.1 – 3.9): Indicates isolated anomalies or early reconnaissance flags (such as a blocked port scan against a public gateway).

• Medium (4.0 – 6.9): Signals a clear shift in behavior that warrants a prompt review (such as an EC2 instance making unexpected outbound network queries).

• High (7.0 – 8.9) / Critical (9.0 – 10.0): Indicates a highly severe, active compromise event (such as an EC2 instance hosting an active cryptominer or an IAM access key executing bulk API commands from a known malicious IP address).

Automated Incident Remediation

GuardDuty integrates directly with Amazon EventBridge to orchestrate immediate, automated defensive responses:

[ GuardDuty Finding ] ---> [ EventBridge Rule ] ---> [ AWS Lambda Function ] ---> [ Isolates Compromised Instance ]

When a high-severity finding is generated, the JSON payload emits an event status change. This can trigger a pre-configured AWS Lambda function or an AWS Systems Manager Automation workflow to dynamically isolate an infected server by swapping its security group, immediately revoke an exposed IAM user's active session tokens, or route a high-priority incident alert ticket to your engineering team's communication channels.