Amazon GuardDuty
#114 · Level 3 · Modern architecture · SecurityConcept
Section titled “Concept”Amazon GuardDuty is a threat detection service that looks for suspicious activity all the time. It analyzes data such as CloudTrail events, VPC Flow Logs and DNS logs on its own, so you don’t have to collect logs separately. It identifies threats using machine learning and by matching against lists of known bad IPs or domains. Each suspicious event is shown as a finding, with a severity level. Findings can be sent to EventBridge and Security Hub.
Simple example
Section titled “Simple example”A security guard for a house, who patrols all night and reports anything unusual.
Why it’s needed
Section titled “Why it’s needed”If a hacker gets in, or someone works with a stolen password, you need to know quickly.
Where it’s used
Section titled “Where it’s used”Catching logins from unfamiliar countries, servers talking to bad addresses, and unusual data downloads.
Azure equivalent
Section titled “Azure equivalent”Microsoft Defender for Cloud
Learn more
Section titled “Learn more”For details and the latest information, see the official documentation: