Ravi Sir's Cards › AWS
What is Amazon GuardDuty?
This revision card explains What is Amazon GuardDuty? It starts from the need that attackers probe keys and dig into unusual API calls while you sleep. It describes guardDuty is threat detection — it watches CloudTrail, VPC Flow, DNS (and more) and raises findings with severity. The how-to section covers how to enable GuardDuty in the account/region , then review findings , then send high severity to a ticket or Lambda. An example on the card is a finding like CredentialAccess:IAMUser/AnomalousBehavior appears with severity and affected resource.
Read card text
What this card says
Why do we need it?
Attackers probe keys and dig into unusual API calls while you sleep.
What is it?
GuardDuty is threat detection: it watches CloudTrail, VPC Flow, DNS (and more) and raises findings with severity.
finding
How to do it
Enable GuardDuty in the account/region → review findings → send high severity to a ticket or Lambda.
Example
A finding like CredentialAccess:IAMUser/AnomalousBehavior appears with severity and affected resource.