Threat Detection with Amazon GuardDuty

Introduction

30 Second Summary

Think about a home security system that learns your family's daily patterns and alerts you only when something truly unusual happens. That's exactly what AI-powered threat detection does for cloud infrastructure.

In this project, you will enable Amazon GuardDuty to protect your AWS account using machine learning and anomaly detection. You'll explore real threat categories, understand how AI identifies attacks, and build an automated email alert pipeline.

What You'll Build

You'll set up a complete AI-powered threat detection system for your AWS account using Amazon GuardDuty, which uses machine learning, anomaly detection, and integrated threat intelligence to continuously monitor for malicious activity.

By the end of this project, you'll have:

• A live GuardDuty detector analyzing CloudTrail logs, VPC Flow Logs, and DNS query logs with AI/ML.
• Sample security findings showing the types of threats GuardDuty can detect across multiple severity levels and threat categories.
• An automated alerting pipeline using EventBridge and SNS that emails you when GuardDuty detects a threat.
• Secret Mission: Create a suppression rule that automatically archives low-severity findings, simulating how security teams tune GuardDuty for their environment.

Are there any prerequisites?

You'll need an AWS account to complete this project. GuardDuty offers a 30-day free trial for new accounts in each Region, so there's no cost to get started.

Before We Start

Before We Start...

Enable Amazon GuardDuty

Every AWS account generates a constant stream of activity logs. API calls, network traffic, DNS queries. Without something watching those logs, a compromised credential or a cryptomining attack can go unnoticed for days.

In this step, you'll enable Amazon GuardDuty, an AI/ML-powered threat detection service that continuously monitors these logs for malicious activity. No agents to install, no infrastructure to manage.

In this step, get ready to:

• Enable GuardDuty in your AWS account.
• Explore the Summary dashboard and understand what GuardDuty monitors.
• Review the protection plans activated under your 30-day free trial.

Navigate to GuardDuty and enable it

GuardDuty lives inside the AWS Management Console. You'll search for it and enable it with all features turned on.

• Sign in to the AWS Management Console at https://console.aws.amazon.com.
• In the search bar at the top, type GuardDuty and select GuardDuty from the results.
• Select the Amazon GuardDuty - All features option.
• Choose Get started.
• On the Welcome to GuardDuty page, choose Enable GuardDuty.

What just happened?

By clicking Enable GuardDuty, you created a GuardDuty detector. A detector is the resource that represents the GuardDuty service in the current Region. It immediately started analyzing your account's activity using AI/ML.

A service-linked role called AWSServiceRoleForAmazonGuardDuty was also created automatically. This gives GuardDuty the permissions it needs to access your logs without you configuring anything manually.

Seeing a message that GuardDuty is already enabled?

If your account previously had GuardDuty enabled in this Region, you may see a dashboard instead of the Welcome page. That means GuardDuty is already active and you can continue to the next substep.

If you see an error about permissions, make sure you are signed in with an account that has administrator access.

help me troubleshoot why I can't enable GuardDuty in my AWS account

Explore the Summary dashboard

Now that GuardDuty is active, take a moment to understand what it monitors. The Summary dashboard gives you an overview of your account's security posture.

• You should now see the GuardDuty Summary dashboard. If you don't, click Summary in the left navigation pane.
• Notice that your dashboard is empty of findings. This is normal for a brand-new setup.

What is GuardDuty monitoring right now?

GuardDuty automatically started analyzing three foundational data sources using AI/ML:

• AWS CloudTrail management events: tracks every API call made in your account (who did what, when, and from where).
• VPC Flow Logs: records network traffic flowing to and from your EC2 instances.
• DNS query logs: captures DNS lookups made by your resources, helping detect communication with known malicious domains.

GuardDuty accesses these logs through an independent stream. You don't need to configure or pay for the log access separately.

What is Extended Threat Detection?

Extended Threat Detection is an AI capability that correlates multiple signals across your data sources, resources, and time into a single high-confidence alert. It detects multi-stage attack sequences that individual findings would miss.

It is automatically enabled for every GuardDuty account at no additional cost. You'll see these attack sequence findings in the next step when you generate sample findings.

Review protection plans

Beyond the three foundational data sources, GuardDuty offers dedicated protection plans that monitor additional AWS services. These were enabled automatically with your 30-day free trial.

• In the left navigation pane, choose Protection plans.
• Review the list of protection types. You should see the following plans enabled:

• S3 Protection monitors CloudTrail data events for S3 to detect threats to your buckets.
• EKS Protection analyzes Kubernetes audit logs for container threats.
• Malware Protection for EC2 scans EBS volumes when GuardDuty detects suspicious behavior on an instance.
• RDS Protection profiles login activity for your databases.
• Lambda Protection monitors network activity from your Lambda functions.

Why so many protection plans?

Each protection plan feeds additional data into GuardDuty's ML models. The more data sources GuardDuty can analyze, the more accurately it can distinguish real threats from normal activity. Think of each plan as giving GuardDuty "eyes" on a different part of your AWS environment.

All of these are covered under the 30-day free trial. You won't be charged anything during this project.

Your threat detection system is live. GuardDuty is now analyzing your account activity in real time. Next up, you'll generate sample findings to see what real threats look like and explore how GuardDuty categorizes them by severity.

Generate and Analyze Sample Findings

Your GuardDuty detector is live and monitoring your account. But since your AWS account is brand new, there's no malicious activity to detect yet.

To understand what real threats look like, GuardDuty lets you generate sample findings. These simulate every type of threat GuardDuty can detect, from cryptocurrency mining to credential compromise to multi-stage attack sequences.

In this step, get ready to:

• Generate sample findings covering every threat type GuardDuty supports.
• Explore findings across Low, Medium, High, and Critical severity levels.
• Examine AI-powered attack sequence findings that correlate multi-stage threats.

Generate sample findings

GuardDuty can generate one sample finding for every finding type it supports. This gives you a full catalogue of threats to explore without waiting for real attacks.

• In the GuardDuty console, choose Settings in the navigation pane on the left.
• Scroll down to the Sample findings section.
• Choose Generate sample findings.

A confirmation banner appears at the top of the page. GuardDuty has created one sample finding for every finding type it supports.

What are sample findings?

Sample findings are simulated security alerts that show you what real threats would look like. They're prefixed with [SAMPLE] so you can easily distinguish them from real detections.

Each sample approximates a real finding but uses placeholder values for things like IP addresses and resource IDs.

Explore findings by severity

GuardDuty categorizes every finding into one of four severity levels. Each level tells you how urgently you need to respond.

• In the navigation pane, choose Findings.
• You should see a long list of findings, all prefixed with [SAMPLE].
• Click the Severity column header to sort findings by severity level.

Notice how findings span four severity levels: Low (reconnaissance), Medium (suspicious activity), High (compromised resources), and Critical (multi-stage attack sequences).

• Click on any finding to open the details pane on the right side.
• In the details pane, review the affected resource, actor information, and remediation recommendations.

What do the severity levels mean?

• Low findings indicate reconnaissance activity. Someone is probing your environment but hasn't caused damage yet.
• Medium findings flag suspicious activity that deviates from normal patterns.
• High findings suggest a resource is actively compromised and needs immediate attention.
• Critical findings represent multi-stage attack sequences detected by GuardDuty's AI. These are the highest priority.

Examine an attack sequence finding

Attack sequence findings are the most advanced detections GuardDuty produces. They represent Extended Threat Detection using AI/ML to correlate multiple signals across time, resources, and data sources into a single high-confidence alert.

• In the Findings list, click the filter bar at the top.
• Filter findings to show only Critical severity.
• Look for findings prefixed with AttackSequence: in the finding type. Examples include AttackSequence:IAM/CompromisedCredentials and AttackSequence:S3/CompromisedData.
• Click on one of the AttackSequence findings to open its details pane.

In the details pane, notice how the finding maps to MITRE ATT&CK tactics and includes prescriptive remediation steps. This is GuardDuty's AI correlating what would otherwise be separate low-confidence signals into one clear story of an attack in progress.

What is Extended Threat Detection?

Extended Threat Detection is GuardDuty's AI-powered capability that identifies multi-stage attack sequences spanning multiple data sources, resources, and time periods. It's enabled by default at no additional cost.

Instead of alerting on each suspicious action individually, it correlates them into a single Critical finding. This reduces noise and gives security teams a complete picture of an attack rather than scattered puzzle pieces.

What is the MITRE ATT&CK framework?

MITRE ATT&CK is a globally recognized knowledge base of adversary tactics and techniques. When GuardDuty maps a finding to ATT&CK, it tells you exactly where in the attack lifecycle the threat sits (initial access, lateral movement, exfiltration, etc.).

You've now seen the full range of threats GuardDuty can detect. Next up, you'll dig deeper into how GuardDuty's AI/ML models actually work to identify these threats.

Understand How GuardDuty Uses AI/ML

In the last step, you explored sample findings across all severity levels and saw how GuardDuty categorizes threats from low-level reconnaissance to critical multi-stage attacks.

Now it's time to look under the hood. GuardDuty doesn't rely on a single detection method. It combines three distinct AI/ML techniques to catch threats that any one method would miss on its own.

In this step, get ready to:

• Examine how GuardDuty's anomaly detection ML model identifies unusual behavior.
• Identify the three detection categories GuardDuty uses and how they map to AI/ML techniques.
• Review a finding's complete JSON structure to understand what downstream services consume.

Examine an anomaly detection finding

Some GuardDuty findings are generated by ML models that learn what "normal" behavior looks like for your account. When something deviates from that baseline, GuardDuty flags it as anomalous.

• Return to the Findings page in the GuardDuty navigation pane.
• In the filter bar at the top, search for findings containing AnomalousBehavior.
• Look for findings like Discovery:S3/AnomalousBehavior or CredentialAccess:IAMUser/AnomalousBehavior.
• Select one of these findings to open the details pane.
• Scroll down in the details pane and find the Anomalous section.
• Note which API calls or behaviors deviated from the ML-modeled baseline.

What is anomaly detection doing here?

GuardDuty continuously models API invocations within your account and incorporates probabilistic predictions to isolate suspicious user behavior. It builds a baseline of what's "normal" for your account over time.

When an API call pattern deviates significantly from that baseline, GuardDuty generates a finding. The Anomalous section shows you exactly which behaviors triggered the alert and how they differed from expectations.

Compare detection methods

GuardDuty doesn't rely on a single technique. It layers three different detection categories, each using a different AI/ML approach.

• Browse through different finding types in your Findings list.
• As you browse, identify which findings fall into each of the three detection categories below.

What are GuardDuty's three detection categories?

• Threat intelligence matches activity against known malicious IPs and domains. This is pattern matching against curated threat feeds.
• ML-based anomaly detection builds behavioral baselines for your account and flags deviations. These are the AnomalousBehavior findings you just examined.
• AI-powered attack sequence correlation (Extended Threat Detection) uses AI to correlate multiple signals across data sources, resources, and time into high-confidence multi-stage attack alerts. These are the AttackSequence: findings with MITRE ATT&CK mappings.

Why does this matter for the AWS AI Practitioner exam?

Each detection category maps to a different AI/ML technique. Threat intelligence is supervised classification against labeled data. Anomaly detection is unsupervised learning of behavioral baselines. Attack sequence correlation is a generative AI approach to reasoning across complex, multi-step events.

Domain 5 of the AWS AI Practitioner exam specifically covers threat detection as a security consideration for AI systems.

Review the finding JSON

Every GuardDuty finding is ultimately a structured JSON document. This is the format that downstream services like EventBridge and Security Hub consume for automated response.

• Select any finding in your Findings list to open the details pane.
• Click the Finding ID at the top of the details pane to view the complete JSON.
• Identify these key fields in the JSON structure:

• type identifies the specific threat category and method.
• severity is the numerical severity rating.
• resource describes the affected AWS resource.
• service.action shows what action triggered the finding.
• service.additionalInfo contains extra context. For sample findings, this includes "sample": true.

Why review the JSON?

In the next step, you'll build an automated alerting pipeline using Amazon EventBridge and Amazon SNS. EventBridge receives these JSON documents as events, and you'll use an Input Transformer to extract specific fields into a human-readable email alert.

Knowing the JSON structure now makes it clear why the alert template references fields like $.detail.severity and $.detail.type.

Spot the sample flag

Look for "sample": true inside service.additionalInfo. In a real environment, this field would be absent. This helps you distinguish test data from actual threats when both exist in the same findings list.

You now understand how GuardDuty applies three distinct AI/ML techniques to catch threats. Next up, you'll put this knowledge to work by building an automated alerting pipeline that turns these JSON findings into email notifications the moment a threat appears.

Set Up Automated Threat Alerts

You now understand how GuardDuty uses three distinct AI/ML techniques to detect threats. But detection alone is not enough.

In a real security operations environment, you need to know about threats the moment they happen. In this step, you'll build an automated alerting pipeline that emails you whenever GuardDuty detects something suspicious, using Amazon EventBridge and Amazon SNS.

In this step, get ready to:

• Create an SNS topic and email subscription for receiving threat alerts.
• Create an EventBridge rule that captures GuardDuty findings.
• Configure an Input Transformer to format alerts into human-readable emails.

Create an SNS topic and email subscription

SNS (Simple Notification Service) is a messaging service that can send notifications to email addresses, phone numbers, and other endpoints. You'll create a topic (a communication channel) and subscribe your email to it.

• Search for SNS in the AWS console search bar and open the Amazon SNS console.
• In the left navigation pane, choose Topics.
• Choose Create topic.
• For Type, select Standard.
• For Name, enter GuardDuty.
• Choose Create topic.

Your topic is created and you're taken to its details page. Now subscribe your email address to it.

• Choose Create subscription.
• For Protocol, select Email.
• For Endpoint, enter your email address.
• Choose Create subscription.

Why do I need to confirm?

SNS requires email subscribers to confirm that they actually want to receive messages. This prevents anyone from signing up an email address they don't own.

• Open your email inbox and look for an email from Amazon SNS with the subject "AWS Notification - Subscription Confirmation".
• Click Confirm subscription in the email.
• A browser tab opens showing a confirmation message with your subscription ID.

Don't see the confirmation email?

• Check your spam or junk folder.
• Make sure you entered the correct email address in the Endpoint field.
• If the email still hasn't arrived after a minute, return to the SNS console, delete the subscription, and create a new one with the correct address.

Ask for help: Why am I not receiving the SNS confirmation email?

Create an EventBridge rule for GuardDuty findings

EventBridge is a serverless event bus that routes events between AWS services in near real-time. You'll create a rule that listens specifically for GuardDuty finding events.

• Search for EventBridge in the AWS console search bar and open the Amazon EventBridge console.
• In the left navigation pane, choose Rules.
• Choose Create rule.
• For Name, enter guardduty-threat-alerts.
• For Event bus, choose default.
• For Rule type, choose Rule with an event pattern.
• Choose Next.

Now you'll define which events this rule should capture.

• For Event source, choose AWS events.
• Under Event pattern, for AWS service, choose GuardDuty.
• For Event type, choose GuardDuty Finding.
• Choose Next.

What does this event pattern do?

This pattern tells EventBridge to listen for any event that GuardDuty publishes when it detects a finding. Every time GuardDuty creates or updates a finding, it automatically emits an event to the default event bus.

Your rule captures all of these events, regardless of severity or type. In production, you could filter for only High or Critical findings to reduce noise.

Configure the target with Input Transformer

Now you'll tell EventBridge where to send matched events and how to format them into a readable email.

• For Target types, choose AWS service.
• For Select a target, choose SNS topic.
• For Topic, select the GuardDuty topic you created earlier.
• Expand the Additional settings section.
• For Configure target input, choose Input transformer.
• Choose Configure input transformer.

The Input Transformer has two fields. The first extracts data from the raw GuardDuty event JSON. The second formats it into a readable message.

• In the Input path field, paste the following:

{"severity": "$.detail.severity", "Finding_ID": "$.detail.id", "Finding_Type": "$.detail.type", "region": "$.region", "Finding_Description": "$.detail.description"}

What does the Input path do?

The Input path extracts specific values from the raw GuardDuty event JSON. Each key (like severity or Finding_Type) becomes a variable you can reference in the template.

The $.detail.severity syntax uses JSONPath to navigate into the event's nested structure. The detail object contains the full GuardDuty finding data.

• In the Template field, paste the following:

"You have a severity <severity> GuardDuty finding type <Finding_Type> in the <region> region."
"Finding Description:"
"<Finding_Description>."

What does the Template do?

The Template turns the extracted values into a human-readable email. The angle brackets (like <severity>) are replaced with the actual values from the Input path at runtime.

Instead of receiving a wall of raw JSON, you'll get a clean message telling you the severity, type, region, and description of each finding.

• Choose Confirm.
• Choose Next.
• On the Configure tags page, choose Next (no tags needed).
• Review the details of your rule and choose Create rule.

You should see a confirmation banner that your rule was created successfully.

Seeing an error when creating the rule?

• Make sure the GuardDuty SNS topic is selected in the target section.
• Double-check that the Input path is valid JSON with no trailing commas or missing quotes.
• Ensure the Template field is not empty. EventBridge requires both fields when using an Input Transformer.

Ask for help: Why is my EventBridge rule failing to create?

Your automated alerting pipeline is in place. Next up, you'll test the full flow by generating new findings and confirming the emails arrive.

Test Your Alerting Pipeline

Your alerting pipeline is fully wired together. Amazon GuardDuty detects threats, EventBridge routes them, and SNS delivers them to your inbox.

But does it actually work? In this step, you'll trigger the pipeline end-to-end by regenerating sample findings and confirming that formatted alerts land in your email.

In this step, get ready to:

• Trigger a test alert by regenerating sample findings.
• Verify that formatted email alerts arrive in your inbox.
• Archive all sample findings to clean up your active view.

Trigger a test alert

Regenerating sample findings simulates new threats flowing into GuardDuty. EventBridge picks up each new finding as an event and routes it to your SNS topic.

• Return to the GuardDuty console.
• In the navigation pane, choose Settings.
• Under Sample findings, choose Generate sample findings.

What happens when you generate sample findings?

GuardDuty creates one sample finding for every finding type it supports. Each finding triggers an event on the default event bus in EventBridge.

Your guardduty-threat-alerts rule matches those events and sends them to your SNS topic, which delivers formatted emails to your confirmed subscription.

Verify email delivery

• Open your email inbox (the address you subscribed to the SNS topic).
• Look for emails from AWS Notifications. Each sample finding generates a separate email, so you may receive many.
• Open one of the alert emails.
• Confirm it contains the severity level, finding type, region, and a description of the threat.

Your alert email should show a formatted message like: "You have a severity 8 GuardDuty finding type Backdoor:EC2/C&CActivity.B in the us-east-1 region." followed by a finding description.

Why does the format matter?

The Input Transformer you configured in EventBridge extracts specific fields from the raw finding JSON and formats them into a human-readable message. This means a security engineer can understand the threat from the email alone, without needing to open the AWS console.

Not seeing any emails?

Check your spam or junk folder. AWS notification emails sometimes get filtered.

Make sure you confirmed the SNS subscription by clicking Confirm subscription in the earlier confirmation email. Unconfirmed subscriptions do not receive messages.

Verify your EventBridge rule is enabled by returning to the EventBridge console, selecting Rules, and confirming that guardduty-threat-alerts shows Enabled in the Status column.

Still stuck? Help me troubleshoot why my GuardDuty alerts aren't arriving in my email.

Archive sample findings

Now that you've confirmed the pipeline works, clean up the sample findings so your active view is ready for real threats.

• Return to the GuardDuty console and choose Findings in the navigation pane.
• Select all findings using the checkbox at the top of the findings list.
• Open the Actions menu and choose Archive.

Your active findings list should now be empty. The archived findings are not deleted. You can view them later by switching the filter from Current to Archived.

Why archive instead of delete?

GuardDuty findings cannot be deleted. Archiving moves them out of your active view so you can focus on new, unresolved threats. In a real environment, security teams archive findings after investigating and remediating them.

Secret mission

Create a Suppression Rule

Real security teams don't investigate every single finding. They tune their detection systems to reduce noise and focus on what matters most. Your mission: create a suppression rule that automatically archives low-severity findings, just like a security operations team would in production.

Clean Up Your Resources

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. GuardDuty is free for 30 days after first enablement, and the SNS topic and EventBridge rule are covered by the free tier for this project's usage level.

Cost warning

After the 30-day free trial ends, GuardDuty charges based on the volume of CloudTrail events, VPC Flow Logs, and DNS query logs it analyzes. For a personal account with minimal activity, this is typically a few dollars per month. If you do not plan to use GuardDuty beyond this project, choose Pause or Delete below.

Resources you used:

• Amazon GuardDuty detector (free for 30 days, then pay-as-you-go based on log volume).
• SNS topic GuardDuty and email subscription (free tier covers 1,000 email notifications per month).
• EventBridge rule guardduty-threat-alerts (free for AWS service events).

Keep everything running

No action needed. Choose this if you are still actively exploring GuardDuty or plan to continue using it for real threat monitoring.

• GuardDuty continues monitoring your account for free during the 30-day trial period.
• After the trial, costs depend on your log volume. For a personal account with minimal activity, expect a few dollars per month at most.
• The SNS topic and EventBridge rule remain active. You will receive email alerts if GuardDuty detects real threats in your account.

Pause - I'll come back to this later

Suspend GuardDuty to stop monitoring and avoid charges without losing your configuration. You can re-enable it later.

• Return to the GuardDuty console.
• In the navigation pane, choose Settings.
• In the Suspend GuardDuty section, choose Suspend GuardDuty.
• Choose Confirm.

Your existing findings and configuration are preserved. GuardDuty stops analyzing logs and generating new findings until you re-enable it.

Delete - I don't want to use this again

Remove all project resources permanently. This deletes your findings, configuration, suppression rules, and alerting pipeline.

Disable GuardDuty:

• Return to the GuardDuty console.
• In the navigation pane, choose Settings.
• In the Suspend GuardDuty section, choose Disable GuardDuty.
• Choose Confirm. This permanently stops monitoring and deletes all findings and configuration in this Region.

Delete the SNS topic:

• Open the Amazon SNS console.
• In the left navigation pane, choose Topics.
• Select the GuardDuty topic, then choose Delete.
• In the Delete topic dialog box, enter delete me and choose Delete.

Delete the EventBridge rule:

• Open the Amazon EventBridge console.
• In the navigation pane, choose Rules.
• Select the guardduty-threat-alerts rule, then choose Actions, then Delete.
• Choose Delete to confirm.

That's a Wrap!

That's a Wrap!

Nice work! You just built an AI-powered security operations center for your AWS account using Amazon GuardDuty.

You now have hands-on experience with exactly how AWS uses AI/ML for security. This is directly relevant to Domain 5 of the AWS AI Practitioner certification.

You learned how to:

• Enable GuardDuty's AI/ML-powered threat detection across CloudTrail management events, VPC Flow Logs, and DNS query logs to continuously monitor your AWS account for malicious activity.
• Analyze sample security findings across all severity levels and understand how GuardDuty applies three detection techniques: threat intelligence, ML-based anomaly detection, and AI-powered attack sequence correlation.
• Build an automated alerting pipeline using EventBridge and SNS that emails you formatted threat notifications whenever GuardDuty detects suspicious activity.
• Create a suppression rule to automatically archive low-severity findings, tuning alert sensitivity like a real security team.

Ready to quiz yourself?