The Problem with Log-Based Security
Your AWS account generates millions of log events per day. Manually reviewing CloudTrail logs for suspicious API calls is like trying to find a pickpocket in a stadium by watching every person simultaneously. You need something that watches all of it automatically and only alerts you when something is genuinely suspicious.
Amazon GuardDuty is a managed threat detection service that continuously analyzes log data using machine learning, anomaly detection, and AWS threat intelligence feeds to identify malicious or unauthorized behavior. You enable it with a single click — no agents to install, no infrastructure to manage.
What GuardDuty Analyzes
GuardDuty ingests and correlates three primary data sources:
| Data Source | What It Reveals | Example Threat Detected |
|---|---|---|
| CloudTrail Management Events | Who is calling which AWS APIs | Root account login, disabling CloudTrail logging, unusual IAM activity |
| VPC Flow Logs | Network traffic metadata (IP, port, bytes — not packet contents) | SSH brute force, communication with known C2 (Command & Control) servers |
| DNS Query Logs | Domain names your instances are resolving | Data exfiltration via DNS tunneling, queries to known malware domains |
GuardDuty also supports optional additional sources: S3 data events (detecting unusual S3 access patterns), EKS audit logs (detecting container escape attempts), RDS login activity, and Lambda network activity.
Findings
When GuardDuty detects something suspicious, it generates a Finding — a structured JSON document describing the threat. Findings have a severity level (Low, Medium, High) and a type that follows a naming convention:
ThreatPurpose:ResourceType/ThreatFamilyName.DetectionMechanism!Artifact
Examples:
- CryptoCurrency:EC2/BitcoinTool.B — EC2 instance communicating with Bitcoin mining pools.
- UnauthorizedAccess:IAMUser/ConsoleLoginSuccess.B — Console login from a Tor exit node.
- Recon:EC2/PortProbeUnprotectedPort — External IP scanning your EC2 instance's ports.
- Exfiltration:S3/AnomalousBehavior — Unusual volume of S3 GetObject calls from an IAM role.
Automated Remediation
GuardDuty findings automatically appear in Amazon EventBridge as events. This is the integration point for automated response:
{
"source": "aws.guardduty",
"detail-type": "GuardDuty Finding",
"detail": {
"severity": 8.0,
"type": "CryptoCurrency:EC2/BitcoinTool.B",
"resource": {
"instanceDetails": {
"instanceId": "i-0abc123def456"
}
}
}
}
An EventBridge rule matching this event can trigger a Lambda function to automatically quarantine the instance by replacing its Security Group with one that denies all traffic — all within seconds of detection, with no human intervention.
A common interview question is: "GuardDuty detected a compromised EC2 instance. Walk me through how you would automatically remediate this without human intervention." The answer is: GuardDuty generates a Finding → EventBridge rule matches on source: aws.guardduty and the specific finding type → Lambda function is triggered → Lambda calls ec2:ModifyInstanceAttribute or ec2:AuthorizeSecurityGroupIngress/ec2:RevokeSecurityGroupIngress to swap the instance's security group to an isolation group that denies all inbound and outbound traffic. Optionally, Lambda also creates a snapshot of the instance for forensic analysis before isolation.