c1.8 Detect active threats
Continuously detect active threats — reconnaissance, credential misuse, command-and-control, anomalous behavior — across your accounts. The simplest way to get there is one-click, managed detection with Amazon GuardDuty; then make sure someone (or an automation) acts on the findings.
Implementation guidance
Managed threat detection in one click
Amazon GuardDuty is the simplest way to detect threats common to cloud environments. Enable it for the whole organization and it analyzes CloudTrail, DNS, VPC flow, and other signals to surface reconnaissance, command-and-control, privilege escalation, credential exfiltration, and anomalous behavior — with no agents or log pipelines to build.
Extended Threat Detection
GuardDuty Extended Threat Detection correlates multiple signals over time into a single attack sequence finding, so a multi-stage attack shows up as one high-severity story instead of scattered low-severity events. Optional protection plans extend coverage to S3, EKS/runtime, RDS login activity, Lambda, and malware.
Detection needs a responder
GuardDuty is a detection service — it only adds value if findings are acted on. Route critical findings to a notification (EventBridge to Amazon SNS) and, ideally, to an automated response. Make sure the team is trained to read GuardDuty findings, and act on the critical/high severity ones first.
Richer, custom detection (SIEM, UEBA, network anomaly detection) is worthwhile later, but the effort and cost put it beyond a Quick Win — GuardDuty gives you strong coverage now.
How it fits together
How to validate
- Is GuardDuty enabled across the whole organization (all accounts and Regions)?
- Are critical findings routed to a notification and/or an automated response?
- Is the team trained to understand and triage GuardDuty findings?
Threats addressed
- GuardDuty detects adversaries early — during reconnaissance and the common attack techniques — before they reach their objective.
- It is a detection service: without someone or something acting on the findings, detection alone does not stop the attack.
AWS services
Amazon GuardDuty 
AWS Security Hub 
Amazon EventBridge Pricing
Amazon GuardDuty bills on the volume analyzed. New accounts get a 30-day free trial that reports the usage you would be billed for so you can estimate cost. See GuardDuty pricing.