Glossary
GuardDuty
AWS's managed threat-detection service: it analyses CloudTrail, VPC Flow Logs, DNS logs and more, and raises typed findings such as PenTest:IAMUser/KaliLinux.
Amazon GuardDuty is a regional threat-detection service. It analyses
foundational data sources — CloudTrail management events, VPC Flow Logs
and DNS logs — plus optional protection plans, and produces findings
with a type (for example UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS
or CryptoCurrency:EC2/BitcoinTool.B), a severity, and the resource and
actor involved.
GuardDuty keeps findings for 90 days; exporting them to S3 keeps them
longer. Because a DeleteDetector call switches it off and discards its
findings, attackers often disable it early — see
detecting StopLogging and GuardDuty disabled.
Reference: GuardDuty IAM finding types.