AWS GuardDuty is the AWS-native threat detection service. It continuously analyses CloudTrail, VPC Flow Logs, DNS logs, EKS audit logs, S3 data events, and (with the malware add-on) attached EBS volumes — emitting findings with severity, MITRE ATT&CK mappings, and remediation hints.
Finding categories every CySA+ candidate should recognise:
- Recon (port scan, anonymising IP).
- UnauthorizedAccess (IAM credential exfiltration, instance credential exfil).
- CryptoCurrency (Bitcoin mining traffic).
- Backdoor / Trojan / Behavior (Tor exit nodes, known C2 IPs).