index.md

Amazon GuardDuty Amazon GuardDuty User Guide

---

Copyright © 2020 Amazon Web Services, Inc. and/or its affiliates. All rights reserved.

---

Amazon's trademarks and trade dress may not be used in connection with any product or service that is not Amazon's, in any manner that is likely to cause confusion among customers, or in any manner that disparages or discredits Amazon. All other trademarks not owned by Amazon are the property of their respective owners, who may or may not be affiliated with, connected to, or sponsored by Amazon.

---

Contents

• What Is Amazon GuardDuty?
• Quotas for Amazon GuardDuty
• Concepts and Terminology
• How Amazon GuardDuty Uses Its Data Sources
• Regions and Endpoints
• Security in Amazon GuardDuty
  • Data Protection in Amazon GuardDuty
  • Managing Access
  • Logging Amazon GuardDuty API Calls with AWS CloudTrail
  • Using Service-Linked Roles for Amazon GuardDuty
  • Compliance Validation for Amazon GuardDuty
  • Resilience in Amazon GuardDuty
  • Infrastructure Security in Amazon GuardDuty
• Setting Up GuardDuty
• Understanding Amazon GuardDuty Findings
  • Finding Details
  • GuardDuty Finding Format
  • Generating Sample Findings in GuardDuty
  • Active Finding Types
    • GuardDuty EC2 Finding Types
    • GuardDuty S3 Finding Types
    • GuardDuty IAM Finding Types
  • Retired Finding Types
• Managing Amazon GuardDuty Findings
  • Filtering Findings
  • Suppression Rules
  • Working with Trusted IP Lists and Threat Lists
  • Exporting Findings
  • Creating Custom Responses to GuardDuty Findings with Amazon CloudWatch Events
• Remediating Security Issues Discovered by GuardDuty
• Managing Multiple Accounts in Amazon GuardDuty
  • Managing GuardDuty Accounts with AWS Organizations
  • Managing GuardDuty Accounts by Invitation
• Suspending or Disabling GuardDuty
• Subscribing to GuardDuty Announcements SNS Topic
• Document History for Amazon GuardDuty