AWS GuardDuty Findings

Location

Description

Managed threat-detection findings generated from AWS foundational data sources such as CloudTrail management events, VPC Flow Logs, Route 53 Resolver query logs, EKS audit telemetry, and related protection plans.

Forensic Value

GuardDuty findings accelerate scoping by surfacing suspicious identities, anomalous API behavior, credential misuse, crypto-mining, exfiltration patterns, and EKS threats that might otherwise require manual multi-source correlation. Findings also preserve service-side context like detector IDs, resource types, severity, and evidence linkage for triage and reporting.

Tools Required

Collection Commands

aws guardduty list-detectors --output json > guardduty_detectors.json

aws guardduty list-findings --detector-id <detector-id> --output json > guardduty_finding_ids.json

aws guardduty get-findings --detector-id <detector-id> --finding-ids <finding-id-1> <finding-id-2> > guardduty_findings.json

Collection Constraints

• •GuardDuty findings are summarized detections, not raw telemetry, and must be validated with the underlying logs.
• •Coverage depends on which GuardDuty protections and foundational data sources were enabled before the incident.

MITRE ATT&CK Techniques

References