GuardDuty for threat detection in AWS - Step-by-Step Execution

Process Flow - GuardDuty for threat detection

Enable GuardDuty

↓

GuardDuty starts monitoring AWS data sources

↓

Analyze data for suspicious activity

↓

Generate findings if threats detected

↓

Send alerts to user or AWS services

↓

User reviews and responds to findings

GuardDuty is enabled to monitor AWS data sources continuously, analyze for threats, generate findings, and alert users for response.

Execution Sample

AWS

1. Enable GuardDuty in AWS Console
2. GuardDuty monitors VPC Flow Logs, CloudTrail, DNS logs
3. GuardDuty analyzes logs for threats
4. Findings generated if suspicious activity found
5. Alerts sent to user or AWS services

This sequence shows how GuardDuty is activated and processes data to detect threats.

Process Table

Step	Action	Data Source Monitored	Threat Detected?	Finding Generated	Alert Sent
1	Enable GuardDuty	None	No	No	No
2	Start monitoring VPC Flow Logs	VPC Flow Logs	No	No	No
3	Start monitoring CloudTrail logs	CloudTrail Logs	No	No	No
4	Start monitoring DNS logs	DNS Logs	No	No	No
5	Analyze VPC Flow Logs	VPC Flow Logs	Yes	Yes	Yes
6	Analyze CloudTrail Logs	CloudTrail Logs	No	No	No
7	Analyze DNS Logs	DNS Logs	No	No	No
8	Send alert to user	Finding from VPC Flow Logs	N/A	N/A	Yes
9	User reviews finding	N/A	N/A	N/A	N/A

💡 All monitored data sources analyzed; alerts sent for detected threats; user notified to respond.

Status Tracker

Variable	Start	After Step 2	After Step 5	After Step 8	Final
GuardDuty Status	Disabled	Enabled	Enabled	Enabled	Enabled
Monitored Data Sources	None	VPC Flow Logs	VPC Flow Logs, CloudTrail Logs, DNS Logs	Same	Same
Threat Detected	No	No	Yes (VPC Flow Logs)	Yes	Yes
Finding Generated	No	No	Yes	Yes	Yes
Alert Sent	No	No	Yes	Yes	Yes

Key Moments - 3 Insights

Why does GuardDuty start with no data sources monitored at first?

Because GuardDuty is initially disabled (Step 1). Only after enabling (Step 2) does it begin monitoring data sources as shown in the execution_table.

How does GuardDuty decide to generate a finding?

GuardDuty analyzes monitored data sources for suspicious activity. When a threat is detected (Step 5), it generates a finding, as seen in the 'Threat Detected?' and 'Finding Generated' columns.

What happens after GuardDuty sends an alert?

After sending an alert (Step 8), the user reviews the finding (Step 9) to decide on further action, completing the threat detection cycle.

Visual Quiz - 3 Questions

Look at the execution table, at which step does GuardDuty first detect a threat?

A Step 5

B Step 2

C Step 7

D Step 9

💡 Hint

Check the 'Threat Detected?' column in the execution_table to find when it changes to 'Yes'.

According to the variable tracker, what is the status of 'Alert Sent' after Step 5?

A No

B Yes

C Unknown

D Pending

💡 Hint

Look at the 'Alert Sent' row in variable_tracker under 'After Step 5'.

If GuardDuty was not enabled at Step 1, how would the execution table change?

A Threats would still be detected from logs

B Alerts would be sent without findings

C No data sources would be monitored and no findings generated

D User would review findings anyway

💡 Hint

Refer to the first row in execution_table where GuardDuty is disabled and no monitoring occurs.

Concept Snapshot

GuardDuty monitors AWS data sources like VPC Flow Logs, CloudTrail, and DNS logs.
It analyzes data continuously for threats.
When threats are found, GuardDuty generates findings.
Alerts notify users to review and respond.
Enable GuardDuty to start threat detection.

Full Transcript

GuardDuty is a security service that you enable in your AWS account. Once enabled, it starts watching important data sources like network traffic logs, user activity logs, and DNS queries. It looks for anything unusual or suspicious that might mean a security threat. When it finds something, it creates a report called a finding and sends an alert to notify you. You then check these findings to decide what to do next. This process helps keep your AWS environment safe by catching threats early.