GuardDuty Data Sources and Finding Types

GuardDuty does not install sensors; it analyzes logs AWS already generates. Its foundational data sources are CloudTrail management events, VPC Flow Logs, and DNS query logs. From these three streams it reconstructs account, network, and name-resolution activity to hunt for threats.

By reading CloudTrail management events, GuardDuty sees the API calls made in your account. This lets it detect identity threats like unusual API activity, credentials used from a strange location, or attempts to disable logging. It also analyzes CloudTrail S3 data events as an optional source.

From VPC Flow Logs, GuardDuty observes network connections, including communication with known malicious IP addresses. It does this even if you have not enabled Flow Logs yourself, because it reads the underlying network data independently. This catches instances reaching out to command-and-control servers.

GuardDuty inspects DNS query logs to spot suspicious domain lookups, such as queries to malware domains or signs of data exfiltration over DNS. This works for instances using the default AWS DNS resolver. Unusual DNS patterns are a strong indicator of compromise.

Beyond the foundational sources, GuardDuty offers add-on protection plans: S3 Protection, EKS (Kubernetes) Protection, Malware Protection, RDS Protection, and Lambda Protection. Each extends detection into a specific service, analyzing its activity for threats relevant to that workload.

GuardDuty findings are grouped into categories by what they describe. Reconnaissance findings show probing and scanning. Instance compromise findings show a workload behaving maliciously. Account compromise findings show suspicious use of credentials or configuration changes.

Each finding has a structured type like Recon:EC2/PortProbeUnprotectedPort or UnauthorizedAccess:IAMUser/MaliciousIPCaller. The format is ThreatPurpose:ResourceType/ThreatName. Decoding it tells you the intent, the affected resource, and the specific behavior detected.

The resource type in a finding (EC2, IAMUser, S3Bucket, Kubernetes) tells you what was affected. The threat purpose (Recon, UnauthorizedAccess, CryptoCurrency, Trojan, Backdoor) tells you the attacker's likely goal. Together they let you triage quickly.

Common findings include crypto-mining on a compromised instance, an exposed access key being used maliciously, port scanning, and a Tor exit node connecting to your resources. Recognizing these typical types helps you respond appropriately rather than treating every finding the same.

The Malware Protection plan can scan the EBS volumes of an instance flagged by a finding, looking for malware without you installing anything. It produces its own malware findings to confirm or strengthen a suspicion. This agentless scanning is a useful add-on when a foundational finding suggests an instance may be infected.

A frequently tested detail: GuardDuty reads its foundational sources independently. You do not have to enable CloudTrail, Flow Logs, or DNS logging yourself for GuardDuty to analyze that activity, and it does not affect or incur charges on your own copies of those logs. This is why GuardDuty can start detecting immediately the moment it is turned on.

Map threats to data sources.

GuardDuty's foundational data sources are CloudTrail (identity and API activity), VPC Flow Logs (network connections), and DNS logs (suspicious lookups), plus optional protection plans for S3, EKS, RDS, Lambda, and malware. Findings use the format ThreatPurpose:ResourceType/ThreatName, letting you triage by intent and affected resource.