In re:Invent 2017, AWS launched one more security service named GuardDuty, which analyzes billions of events in pursuit of trends, patterns, and anomalies that are recognizable signs that something is not right.
It takes input from multiple data streams, including several threat intelligence feeds, staying aware of malicious IP addresses, devious domains, and, more importantly, learning to accurately identify malicious or unauthorized behavior.
GuardDuty takes information from VPC Flow Logs, AWS CloudTrail event logs, and DNS logs. This allows GuardDuty to detect many different types of dangerous and mischievous behavior, including probes for known vulnerabilities, port scans and probes, and access from unusual locations.
