AWS for DevOps — GuardDuty

13.1 — GuardDuty

GuardDuty is an intelligent threat detection service that continuously monitors your AWS account for malicious activity and unauthorized behavior. It uses machine learning, anomaly detection, and threat intelligence feeds.

Real-World Analogy

GuardDuty is like a security guard watching camera feeds with AI assistance. The guard doesn’t just watch — they have software that flags unusual behavior: someone entering a restricted area at 3 AM, a vehicle circling the building repeatedly, or a known criminal’s face appearing on camera.

What GuardDuty Monitors

Data Source	What It Catches
CloudTrail Events	Unusual API calls, credential abuse
VPC Flow Logs	Port scanning, data exfiltration
DNS Logs	Communication with known malicious domains
S3 Data Events	Suspicious S3 access patterns
EKS Audit Logs	Kubernetes-specific threats

Enabling GuardDuty

# Enable GuardDuty (one-click)
$ aws guardduty create-detector --enable
{
    "DetectorId": "abc123def456"
}

# Check status
$ aws guardduty get-detector --detector-id abc123def456
{
    "Status": "ENABLED",
    "FindingPublishingFrequency": "SIX_HOURS"
}

Finding Types

Category	Example Finding	Severity
Reconnaissance	Port scan detected	Low
Instance Compromise	EC2 communicating with bitcoin mining pool	High
Account Compromise	API called from Tor exit node	High
S3 Compromise	S3 bucket made public by unusual principal	High
Credential Compromise	Credentials used from unusual location	Medium

Viewing Findings

# List findings
$ aws guardduty list-findings \
    --detector-id abc123def456 \
    --finding-criteria '{
      "Criterion": {
        "severity": {"Gte": 7}
      }
    }'

# Get finding details
$ aws guardduty get-findings \
    --detector-id abc123def456 \
    --finding-ids "finding-id-123"
{
    "Findings": [{
        "Type": "UnauthorizedAccess:EC2/MaliciousIPCaller.Custom",
        "Severity": 8,
        "Title": "EC2 instance communicating with known malicious IP",
        "Description": "EC2 instance i-0abc123 is communicating with IP 1.2.3.4...",
        "Resource": {
            "ResourceType": "Instance",
            "InstanceDetails": {
                "InstanceId": "i-0abc123def456"
            }
        }
    }]
}

Auto-Remediation with EventBridge

# Create an EventBridge rule for high-severity GuardDuty findings
$ aws events put-rule \
    --name guardduty-high-severity \
    --event-pattern '{
      "source": ["aws.guardduty"],
      "detail-type": ["GuardDuty Finding"],
      "detail": {
        "severity": [{"numeric": [">=", 7]}]
      }
    }'

# Target: Lambda function to isolate compromised instance
$ aws events put-targets \
    --rule guardduty-high-severity \
    --targets '[{
      "Id": "isolate-instance",
      "Arn": "arn:aws:lambda:ap-south-1:123456789012:function:isolate-compromised-instance"
    }]'

Common Mistakes

Mistake	Why It Hurts	Fix
Not enabling GuardDuty	No threat detection	Enable in all regions
Ignoring low-severity findings	Small issues escalate	Review weekly; automate triage
No auto-remediation	Threats persist until manual response	Use EventBridge + Lambda
Single-account only	Threats in member accounts missed	Enable across all accounts via Organizations

Quick Reference

Task	Command
Enable GuardDuty	aws guardduty create-detector --enable
List findings	aws guardduty list-findings --detector-id ID
Get finding details	aws guardduty get-findings --detector-id ID --finding-ids FID
Archive finding	aws guardduty archive-findings --detector-id ID --finding-ids FID
Create sample findings	aws guardduty create-sample-findings --detector-id ID

---

Next → Security Hub