c2.8 Triage GuardDuty findings and enable protection plans

Investigate beyond the critical findings

A foundational detective practice is to triage most Amazon GuardDuty findings, not only the critical ones. Medium and low findings often reveal reconnaissance and early compromise attempts. For example, an SSH brute force finding means an adversary is probing an exposed SSH service — even a failed attempt is a signal to close that vector (for example, manage instances with Session Manager and remove open administration ports from security groups).

Enable protection plans for deeper coverage

GuardDuty's optional protection plans widen what it can detect:

• Runtime Monitoring — an agent that observes activity inside EC2, ECS, and EKS workloads, pinpointing the process and container behind suspicious behavior for faster isolation.
• Malware Protection — scans EBS volumes of instances flagged by a finding, agentless, with no performance impact; also available for Amazon S3.
• S3 Protection — detects suspicious access to your S3 buckets.
• RDS Protection — flags anomalous and brute-force login attempts against Amazon Aurora and RDS.
• EKS Protection and Lambda Protection — extend coverage to Kubernetes control-plane activity and Lambda network activity.

Correlate with Extended Threat Detection

GuardDuty Extended Threat Detection automatically correlates events across data sources to surface multi-stage attack sequences as a single finding. Enabling more protection plans widens the range of sequences it can detect.