Amazon GuardDuty

Protect your AWS accounts, workloads, and data with intelligent threat detection

Benefits of Amazon GuardDuty

Keep your accounts, workloads, and data secure by continuously monitoring for potential threats across your AWS environment.
Expose threats quickly using anomaly detection, machine learning (ML), behavioral modeling, and threat intelligence feeds from AWS and leading third parties.
Accurately detect and respond to threats earlier, helping you detect them before they escalate to broader business-impacting events.
Scale threat detection across all accounts in your AWS environment without requiring manual effort or third-party tooling.
Safeguard your accounts, data, and resources across various AWS compute types, spanning Amazon Elastic Compute Cloud (Amazon EC2), serverless workloads, and container workloads—including those on AWS Fargate.

What is GuardDuty?

Amazon GuardDuty combines ML and integrated threat intelligence from AWS and leading third parties to help protect your AWS accounts, workloads, and data from threats.

How it works

Amazon GuardDuty is a threat detection service that continuously monitors your AWS accounts and workloads for malicious activity and delivers detailed security findings for visibility and remediation.

How Amazon GuardDuty works

GuardDuty for AWS workload protection

Learn more about how you can apply the broad threat detection coverage in GuardDuty to workloads and resources across your AWS environment.

GuardDuty for AWS workload protection

Learn more about how you can apply the broad threat detection coverage in GuardDuty to workloads and resources across your AWS environment.

Use cases

Identify anomalous behavior like abnormal removal of artificial intelligence (AI) security guardrails, model usage, or exfiltrated Amazon EC2 credentials being used to call APIs in Amazon Bedrock, Amazon SageMaker, or self-managed AI workloads.

Receive findings with context, metadata, and impacted resource details. Determine root cause with Amazon Detective. Route findings to AWS Security Hub and Amazon EventBridge.

Initiate scans of your Amazon Elastic Block Store (Amazon EBS) volumes associated with your Amazon EC2 instances and container workloads, and automatically monitor uploads to Amazon S3 buckets, to detect the presence of malware, such as backdoor intrusions, cryptocurrency-related activity, and trojans.

Remove complexity for security and application teams with a single place to identify, profile, and manage threats to your AWS container environments across Amazon EKS and Amazon ECS—including both instance and serverless container workloads

Demonstrate ability to meet intrusion detection requirements mandated by certain compliance frameworks. 


Explore more of AWS