Amazon GuardDuty
GuardDuty is a threat detection service designed to help protect AWS resources and workloads by continuously monitoring for malicious activity and unauthorized behavior. Note that this is a detection service and not a response service. It detects and notifies the user of a potential threat within an AWS resource. However, integration with automated services such as Lambda will enhance GuardDuty’s capabilities to respond to threats based on established playbooks for each threat detected. GuardDuty uses ML, anomaly detection, and integrated TI to identify potential security threats within your AWS environment.
Some DFIR use cases are as follows:
- Threat detection: GuardDuty analyzes CloudTrail logs, VPC flow logs, and DNS logs to detect indicators of compromise (IOCs) and potential threats. It applies ML algorithms to identify patterns and anomalies that might indicate malicious activities, such as unauthorized access attempts, reconnaissance, or instances...
