GuardDuty is a continuous monitoring service offered by AWS that identifies and alerts about suspicious or unwanted behavior within an account. There are currently three data sources that it analyzes, which are virtual private cloud (VPC) flow logs, CloudTrail event logs, and domain name system (DNS) logs. Note that VPC flow logging and CloudTrail event logging do not need to be enabled on your account for GuardDuty to use them, and there is currently no way to review DNS logs in AWS. This means that even if there are no flow logs active in the environment and CloudTrail is disabled, GuardDuty will still generate findings from VPC flow logs, CloudTrail event logs, and DNS logs.
It is also important ...
