Certablo
Sign inCreate account
← Knowledge Base
Security & Identityservice

Amazon GuardDuty

Managed threat detection for AWS accounts and workloads: foundational telemetry, protection-plan data sources, threat intelligence, machine learning, findings and the difference between detecting a threat and enforcing preventive controls.

CLF-C02SAA-C03

Visual overview

DEFENSE IN DEPTHIdentity, data, network, detection, and audit controls protect different boundaries
IDENTITYAuthenticate + authorizePrincipals · policies · temporary credentials
DATAEncrypt + protect secretsKeys · certificates · application secrets
DETECT & AUDITFind threats + retain evidenceFindings · API history · configuration state
No single security service replaces the others. Strong AWS security combines preventive, detective, and evidence-producing controls around the workload.
AWS SERVICE MAPThreat-detection flow

GuardDuty analyzes AWS activity and network telemetry and produces security findings; CloudTrail remains the broader audit evidence source and VPC telemetry contributes network context.

CloudTrailAPI activity signal
Amazon VPCNetwork-flow and DNS context
GuardDutyThreat detection and findings
EXAM-RELEVANT MECHANICS

Technical reference

GuardDuty turns supported telemetry into findings; know what data class is analyzed, what the finding means, and what still needs a separate response control.

Foundational telemetryCloudTrail + Flow Logs + DNS logs

GuardDuty automatically analyzes supported management events, VPC flow information, and Route 53 Resolver DNS query activity after enablement.

Detection techniquesThreat intel + behavioral/ML models

AWS combines threat-intelligence indicators and analytical models to identify suspicious activity.

Primary outputFinding

A finding identifies the type of suspicious activity, affected resources and context for investigation.

PrioritizationSeverity

Findings carry a numeric severity mapped to descriptive severity bands for triage.

Noise controlSuppression rule

A matching finding filter with ARCHIVE action can automatically archive accepted patterns without turning off detection.

CorrelationAttack sequence

Extended Threat Detection can correlate multiple signals over time and data sources into supported multi-stage attack findings.

GuardDuty analyzes security telemetry instead of sitting inline

Amazon GuardDuty is a managed threat detection service that continuously analyzes supported AWS data sources for suspicious or malicious activity. Foundational sources include AWS CloudTrail management activity, VPC Flow Logs, and Route 53 Resolver DNS query logs as documented by GuardDuty. AWS operates the detection service; customers do not deploy an inline network appliance merely to enable these foundational analyses.

GuardDuty combines AWS and third-party threat intelligence with behavioral and machine-learning detection techniques. Additional protection plans can analyze other telemetry for services and workloads, such as supported S3, container, database, runtime, Lambda, and malware-protection contexts. These optional protections have their own enablement and cost behavior, so 'GuardDuty is on' does not automatically imply that every optional protection plan is collecting every possible data source.

Findings are structured signals for investigation and automation

When GuardDuty detects a condition that matches a finding type, it creates a finding containing the affected resource, account and Region context, evidence about the observed activity, a finding type, timestamps, and a severity value. Severity is intended to help prioritize investigation; it is not proof by itself that compromise occurred. Analysts should validate the surrounding identity, resource, and network evidence before choosing containment steps.

Findings can be filtered, archived, and routed into broader security operations. Suppression rules are filters with an archive action for known, accepted patterns, reducing noise without disabling the underlying detector. Automation should be designed conservatively: a high-confidence signal might trigger credential revocation or isolation, while an ambiguous signal may be better routed for human review.

Foundational data access is managed separately from your log delivery

A useful operational distinction is that GuardDuty obtains supported foundational telemetry directly for analysis; customers do not have to create a CloudTrail trail or independently enable VPC Flow Logs just so GuardDuty can analyze those foundational sources. You may still configure CloudTrail trails, Flow Logs, and centralized log storage for your own audit, forensics, retention, or SIEM needs. GuardDuty detection and customer-owned log archives solve different problems.

GuardDuty can also correlate signals over time through supported extended threat-detection capabilities. That shifts the analyst view from isolated events toward attack sequences. Even then, scope matters: findings describe what GuardDuty observed in enabled accounts, Regions, and protection plans. Organization-wide security therefore needs consistent enablement, delegated administration, and a response process that can act across accounts.

Key takeaways

  1. 01

    GuardDuty is managed threat detection, not an inline preventive firewall.

  2. 02

    Foundational analysis includes CloudTrail management activity, VPC Flow Logs, and Route 53 Resolver DNS query logs without requiring customers to configure those logs specifically for GuardDuty.

  3. 03

    Optional protection plans extend coverage and must be evaluated separately from foundational GuardDuty enablement.

  4. 04

    Findings contain severity and resource context for investigation; they are security signals rather than automatic proof of compromise.

  5. 05

    Suppression and automation should reduce noise while preserving the ability to investigate meaningful threats.

Official AWS sources

Use these primary AWS resources for the source material behind this article and for deeper reference.