> For the complete documentation index, see [llms.txt](https://notebook.iuriioapps.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notebook.iuriioapps.com/cloud/aws/security_and_compliance/guardduty.md).

# GuardDuty

* It is a managed threat detection service
* Continuously monitors multiple AWS accounts for malicious activity or unusual behavior
* Detection types
  * Reconnaissance attacks - brute force, port scans, port probes, etc
  * Instance compromises - malicious communications, spambot activities, outbound SSH brute force attacks, EC2 credential exfiltration, etc
  * Account compromises - malicious API calls, disabled CloudTrail, password compromises
* Simple dashboard view
* CloudWatch event triggers, with further partner integrations: Splunk, CrowdStrike, SumoLogic, etc.
* Behavioral anomalies
* Monitors CloudTrail, VPC flow logs and more
* Continually updated
  * Public Security intelligence feeds
  * Malicious IP addresses
  * Partner intelligence feeds
  * Machine learning models
  * Abnormal behavior