AWS Security Cookbook

There's more...

Let's go through some important concepts related to GuardDuty:

• GuardDuty can detect compromised EC2 instances by analyzing VPC flow logs—for example, GuardDuty can detect whether an instance is used in a denial of service (DOS) attack.
• GuardDuty can detect whether our instances have been used for cryptocurrency mining.
• GuardDuty can detect whether our credentials have been stolen by accessing malicious IPs, using EC2 instance profiles outside of EC2, and so on.
• We can aggregate GuardDuty findings across different accounts into one account. We will discuss this in the Aggregating findings from multiple accounts in GuardDuty recipe.
• We can export GuardDuty findings across different accounts and regions to an Amazon S3 bucket ...