GuardDuty for threat detection in AWS - Step-by-Step Execution

Process Flow - GuardDuty for threat detection

Enable GuardDuty

↓

GuardDuty starts monitoring AWS data sources

↓

Analyze data for suspicious activity

↓

Generate findings if threats detected

↓

Send alerts to user or AWS services

↓

User reviews and responds to findings

GuardDuty is enabled to monitor AWS data sources continuously, analyze for threats, generate findings, and alert users for response.

Execution Sample

AWS

1. Enable GuardDuty in AWS Console
2. GuardDuty monitors VPC Flow Logs, CloudTrail, DNS logs
3. GuardDuty analyzes logs for threats
4. Findings generated if suspicious activity found
5. Alerts sent to user or AWS services

This sequence shows how GuardDuty is activated and processes data to detect threats.

Process Table

Step	Action	Data Source Monitored	Threat Detected?	Finding Generated	Alert Sent
1	Enable GuardDuty	None	No	No	No
2	Start monitoring VPC Flow Logs	VPC Flow Logs	No	No	No
3	Start monitoring CloudTrail logs	CloudTrail Logs	No	No	No
4	Start monitoring DNS logs	DNS Logs	No	No	No
5	Analyze VPC Flow Logs	VPC Flow Logs	Yes	Yes	Yes
6	Analyze CloudTrail Logs	CloudTrail Logs	No	No	No
7	Analyze DNS Logs	DNS Logs	No	No	No
8	Send alert to user	Finding from VPC Flow Logs	N/A	N/A	Yes
9	User reviews finding	N/A	N/A	N/A	N/A

💡 All monitored data sources analyzed; alerts sent for detected threats; user notified to respond.

Status Tracker

Variable	Start	After Step 2	After Step 5	After Step 8	Final
GuardDuty Status	Disabled	Enabled	Enabled	Enabled	Enabled
Monitored Data Sources	None	VPC Flow Logs	VPC Flow Logs, CloudTrail Logs, DNS Logs	Same	Same
Threat Detected	No	No	Yes (VPC Flow Logs)	Yes	Yes
Finding Generated	No	No	Yes	Yes	Yes
Alert Sent	No	No	Yes	Yes	Yes

Key Moments - 3 Insights

Why does GuardDuty start with no data sources monitored at first?

Because GuardDuty is initially disabled (Step 1). Only after enabling (Step 2) does it begin monitoring data sources as shown in the execution_table.

How does GuardDuty decide to generate a finding?

GuardDuty analyzes monitored data sources for suspicious activity. When a threat is detected (Step 5), it generates a finding, as seen in the 'Threat Detected?' and 'Finding Generated' columns.

What happens after GuardDuty sends an alert?

After sending an alert (Step 8), the user reviews the finding (Step 9) to decide on further action, completing the threat detection cycle.

Visual Quiz - 3 Questions

Look at the execution table, at which step does GuardDuty first detect a threat?

A Step 5

B Step 2

C Step 7

D Step 9

💡 Hint

Check the 'Threat Detected?' column in the execution_table to find when it changes to 'Yes'.

According to the variable tracker, what is the status of 'Alert Sent' after Step 5?

A No

B Yes

C Unknown

D Pending

💡 Hint

Look at the 'Alert Sent' row in variable_tracker under 'After Step 5'.

If GuardDuty was not enabled at Step 1, how would the execution table change?

A Threats would still be detected from logs

B Alerts would be sent without findings

C No data sources would be monitored and no findings generated

D User would review findings anyway

💡 Hint

Refer to the first row in execution_table where GuardDuty is disabled and no monitoring occurs.

Concept Snapshot

GuardDuty monitors AWS data sources like VPC Flow Logs, CloudTrail, and DNS logs.
It analyzes data continuously for threats.
When threats are found, GuardDuty generates findings.
Alerts notify users to review and respond.
Enable GuardDuty to start threat detection.

Full Transcript

GuardDuty is a security service that you enable in your AWS account. Once enabled, it starts watching important data sources like network traffic logs, user activity logs, and DNS queries. It looks for anything unusual or suspicious that might mean a security threat. When it finds something, it creates a report called a finding and sends an alert to notify you. You then check these findings to decide what to do next. This process helps keep your AWS environment safe by catching threats early.

Practice

1. What is the main purpose of AWS GuardDuty?

easy

A. To manage user permissions and access control

B. To automatically detect threats and suspicious activity in your AWS environment

C. To store and backup data securely

D. To deploy applications automatically

Solution

1. Step 1: Understand GuardDuty's role

   GuardDuty is a security service that watches your AWS environment for threats.

2. Step 2: Compare options

   Only To automatically detect threats and suspicious activity in your AWS environment describes threat detection, which is GuardDuty's main function.

3. Final Answer:

   To automatically detect threats and suspicious activity in your AWS environment -> Option B

4. Quick Check:

   GuardDuty = Threat detection [OK]

Hint: GuardDuty = automatic threat detection service [OK]

Common Mistakes:

• Confusing GuardDuty with access management
• Thinking GuardDuty stores data
• Assuming GuardDuty deploys apps

2. Which AWS service must be enabled to start using GuardDuty?

easy

A. AWS CloudTrail

B. AWS IAM

C. AWS Config

D. Amazon GuardDuty

Solution

1. Step 1: Identify the service to enable

   GuardDuty is a separate AWS service that must be enabled to start threat detection.

2. Step 2: Check other services' roles

   CloudTrail logs events, Config tracks resource changes, IAM manages permissions, but none start GuardDuty.

3. Final Answer:

   Amazon GuardDuty -> Option D

4. Quick Check:

   Enable GuardDuty service to start detection [OK]

Hint: Enable GuardDuty service itself to start detection [OK]

Common Mistakes:

• Confusing CloudTrail with GuardDuty
• Thinking IAM enables GuardDuty
• Assuming Config starts GuardDuty

3. After enabling GuardDuty, which of the following best describes what happens next?

medium

A. GuardDuty disables CloudTrail to reduce noise

B. You must manually upload logs for GuardDuty to analyze

C. GuardDuty immediately starts analyzing AWS logs and network activity for threats

D. GuardDuty automatically deletes suspicious resources

Solution

1. Step 1: Understand GuardDuty's automatic behavior

   GuardDuty automatically analyzes AWS logs and network data once enabled.

2. Step 2: Evaluate other options

   Manual log upload is not needed, CloudTrail is not disabled, and GuardDuty does not delete resources.

3. Final Answer:

   GuardDuty immediately starts analyzing AWS logs and network activity for threats -> Option C

4. Quick Check:

   GuardDuty auto-analyzes logs after enablement [OK]

Hint: GuardDuty auto-analyzes logs; no manual upload needed [OK]

Common Mistakes:

• Thinking manual log upload is required
• Believing GuardDuty disables CloudTrail
• Assuming GuardDuty deletes resources

4. You enabled GuardDuty but are not receiving any findings. What is a likely cause?

medium

A. GuardDuty is not enabled in the correct AWS region

B. You forgot to create an IAM user

C. CloudTrail is disabled globally

D. GuardDuty requires manual log uploads

Solution

1. Step 1: Check GuardDuty regional enablement

   GuardDuty must be enabled in each AWS region to detect threats there.

2. Step 2: Review other options

   IAM user creation is unrelated to findings, CloudTrail is enabled by default in most regions, and GuardDuty does not require manual uploads.

3. Final Answer:

   GuardDuty is not enabled in the correct AWS region -> Option A

4. Quick Check:

   GuardDuty region enablement affects findings [OK]

Hint: Enable GuardDuty in the right region to get findings [OK]

Common Mistakes:

• Assuming IAM user creation triggers findings
• Believing CloudTrail must be manually enabled everywhere
• Thinking GuardDuty needs manual log uploads

5. You want to monitor multiple AWS accounts for threats centrally using GuardDuty. What is the best approach?

hard

A. Use GuardDuty's multi-account feature with a master account to manage findings centrally

B. Enable GuardDuty separately in each account and region, then aggregate findings manually

C. Create IAM roles in each account to share logs with a central S3 bucket for GuardDuty analysis

D. Disable GuardDuty in member accounts and rely on CloudTrail logs only

Solution

1. Step 1: Understand GuardDuty multi-account setup

   GuardDuty supports a master account that can manage and view findings from member accounts centrally.

2. Step 2: Evaluate other options

   Manual aggregation is inefficient, sharing logs via S3 is not how GuardDuty works, and disabling GuardDuty loses threat detection.

3. Final Answer:

   Use GuardDuty's multi-account feature with a master account to manage findings centrally -> Option A

4. Quick Check:

   GuardDuty multi-account = master account management [OK]

Hint: Use GuardDuty master account for multi-account threat management [OK]

Common Mistakes:

• Trying manual aggregation of findings
• Using S3 buckets for GuardDuty log sharing
• Disabling GuardDuty in member accounts