Study guide
15.3 Automated Threat Detection: GuardDuty, Inspector & Security Hub
AWS Certified DevOps Engineer – Professional Exam
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: CI/CD Pipeline Architecture & Source Integration
1.1 Multi-Stage & Multi-Account CodePipeline Design 1.2 CodeBuild Projects, Build Environments & Pipeline Secrets 1.3 Source Control Workflows, Webhooks & Branching Models
2 Chapter 2: Automated Testing, Test Gates & Quality Verification
2.1 Automated Unit, Integration & Acceptance Testing in Pipelines 2.2 Load Testing, Performance Benchmarking & Synthetic Canaries 2.3 Security Scanning, SAST/DAST & Approval Gates
3 Chapter 3: Artifact Management & Multi-Platform Deployment Strategies
3.1 Artifact Lifecycle Management with CodeArtifact, ECR & S3 3.2 Automated Image Baking with EC2 Image Builder 3.3 In-Place, Rolling & Immutable Deployments on EC2 3.4 Blue/Green & Canary Deployments for ECS, EKS & Lambda
4 Chapter 4: CloudFormation, CDK & Reusable IaC Components
4.1 Advanced CloudFormation: Nested Stacks, Change Sets & Custom Resources 4.2 Cross-Account & Multi-Region StackSets & Drift Detection 4.3 Modern IaC: AWS CDK, SAM & Service Catalog Governance
5 Chapter 5: Multi-Account Architecture, Organizations & Control Tower
5.1 AWS Organizations Hierarchy, OUs & Account Provisioning 5.2 Service Control Policies (SCPs) & Multi-Account Guardrails 5.3 AWS Control Tower, Account Factory & Landing Zone Automation
6 Chapter 6: Systems Manager & Large-Scale Fleet Configuration
6.1 SSM Agent, Hybrid Activation & Session Manager 6.2 Systems Manager Run Command, State Manager & Associations 6.3 Patch Manager, Parameter Store vs Secrets Manager & AppConfig
7 Chapter 7: High Availability & Multi-Region Resiliency
7.1 Designing Resilient Multi-AZ & Multi-Region Architectures 7.2 Route 53 Traffic Flow, Health Checks & DNS Failover 7.3 Data Replication: Aurora Global DB, DynamoDB Global Tables & S3 CRR
8 Chapter 8: Scalability, Auto Scaling & Disaster Recovery Automation
8.1 EC2 Auto Scaling Policies, Lifecycle Hooks & Warm Pools 8.2 Container & Serverless Scalability: ECS Capacity Providers, EKS & API Gateway 8.3 Disaster Recovery Strategies: RTO, RPO & Architecture Tiers 8.4 Automated Backup & Recovery with AWS Backup & Elastic Disaster Recovery
9 Chapter 9: CloudWatch Metrics, Agent Collection & Log Aggregation
9.1 CloudWatch Metrics, Dimensions, Metric Math & High Resolution 9.2 Unified CloudWatch Agent & Custom Metric Collection 9.3 Centralized Log Aggregation, Retention & Cross-Account Subscriptions
10 Chapter 10: Log Analysis, Dashboards & Distributed Tracing with X-Ray
10.1 CloudWatch Logs Insights, Filter Syntax & Query Optimization 10.2 CloudWatch Dashboards, Composite Alarms & Anomaly Detection 10.3 Distributed Tracing with AWS X-Ray & Service Maps
11 Chapter 11: Automated Observability & Event-Driven Monitoring
11.1 Application & Infrastructure Health Checks with Route 53 & ALB 11.2 Centralized Observability with Amazon OpenSearch & Athena 11.3 Synthetic Monitoring with CloudWatch Synthetics Canaries
12 Chapter 12: Event-Driven Incident Detection & Notification Pipelines
12.1 AWS Health, CloudTrail Events & Operational Notification 12.2 EventBridge Event Routing, Patterns & Multi-Account Buses 12.3 Asynchronous Event Processing: SNS, SQS Queues & Dead-Letter Handling
13 Chapter 13: Automated Remediation & Deployment Troubleshooting
13.1 AWS Config Managed Rules & Automated Remediation with SSM 13.2 Event-Driven Infrastructure Self-Healing with Lambda & Step Functions 13.3 Troubleshooting CI/CD Pipeline & Deployment Failures 13.4 Root Cause Analysis for Auto Scaling & Container Failures
14 Chapter 14: Identity, Access Management & Secrets at Scale
14.1 IAM Policy Evaluation Logic, NotAction & Explicit Denies 14.2 IAM Permissions Boundaries & Delegated Administration 14.3 IAM Identity Center, Cross-Account Roles & STS Session Policies 14.4 Automated Secrets Management & Secret Rotation with Secrets Manager
15 Chapter 15: Security Automation, Data Protection & Compliance Auditing
15.1 Network Security Automation: Security Groups, NACLs, Network Firewall & WAF 15.2 Cryptographic Controls & Key Management with AWS KMS & ACM 15.3 Automated Threat Detection: GuardDuty, Inspector & Security Hub 15.4 Continuous Compliance Auditing & Log Integrity with CloudTrail & Config
15.3 Automated Threat Detection: GuardDuty, Inspector & Security Hub
Key Takeaways Explain This Topic AI
Amazon GuardDuty provides continuous, serverless, and agentless threat intelligence by analyzing CloudTrail management/data logs, VPC Flow Logs, DNS logs, EKS audit logs, RDS login logs, and EBS volume snapshots using machine learning and anomaly detection.
GuardDuty findings are assigned severity values on a 1.0–10.0 scale grouped into four levels — Low (1.0–3.9), Medium (4.0–6.9), High (7.0–8.9), and Critical (9.0–10.0) — pinpointing threats such as EC2 cryptocurrency mining, Tor exit node communications, and IAM credential exfiltration outside AWS.
Amazon Inspector delivers automated, continuous vulnerability assessments across Amazon EC2 instances (via SSM Agent or agentless scanning), Amazon ECR container repositories (continuous scanning), and AWS Lambda functions, computing contextual risk scores against Common Vulnerabilities and Exposures (CVEs).
AWS Security Hub acts as the centralized security posture management hub, ingesting and normalizing findings from GuardDuty, Inspector, Macie, IAM Access Analyzer, and third-party tools into the standard AWS Security Finding Format (ASFF).
Security Hub continuously measures compliance against recognized security benchmarks (CIS AWS Foundations Benchmark, AWS Foundational Security Best Practices, PCI DSS), dispatching findings to Amazon EventBridge to execute automated remediation via AWS Systems Manager Automation or Lambda.
Last updated: September 2026
Automated Threat Detection & Security Posture Architecture
Enterprise DevOps environments require real-time visibility into unauthorized behaviors, software vulnerabilities, and compliance drift across hundreds of accounts. AWS provides a coordinated triad of automated detection and posture management services: [ Telemetry Sources: CloudTrail, VPC Flow, DNS, EKS, EBS ]
- │
- ▼
- ┌────────────────────────────────────────────────────────┐
- │ Amazon GuardDuty (Behavioral Anomaly & Threat Intel) │
- └──────────────────────────┬─────────────────────────────┘
- │
- [ Compute Assets: EC2, ECR Containers, Lambda Functions ]
- │
- ▼
- ┌────────────────────────────────────────────────────────┐
- │ Amazon Inspector (Continuous CVE Vulnerability Scans) │
- └──────────────────────────┬─────────────────────────────┘
- │
- ▼ Normalized ASFF Findings
- ┌────────────────────────────────────────────────────────┐
- │ AWS Security Hub (Centralized Posture & Compliance) │
- │ • CIS AWS Foundations Benchmark • AWS FSBP • PCI-DSS │
- └──────────────────────────┬─────────────────────────────┘
- │ Near-Real-Time Findings
- ▼
- ┌────────────────────────────────────────────────────────┐
- │ Amazon EventBridge (Event Pattern Matching) │
- └───────┬────────────────────────────────────────┬───────┘
- ▼ ▼
- [ AWS Systems Manager Automation ] [ AWS Lambda Remediation ]
- (Quarantine SG / Snapshot Host) (Revoke Stolen IAM Session)
- Amazon GuardDuty: Intelligent Threat Detection
Amazon GuardDuty is a fully managed, serverless threat detection service that continuously monitors AWS accounts and workloads for malicious activity and unauthorized behavior. Crucially, GuardDuty is completely agentless and operates independently of customer compute resources, meaning it incurs zero performance overhead on running applications.
Telemetry Ingestion Streams
GuardDuty ingests massive volumes of operational telemetry directly from the underlying AWS service virtualization layer:
AWS CloudTrail Management Events : Monitors control plane API calls for unauthorized reconnaissance, privilege escalation, and console logins from Tor exit nodes.
AWS CloudTrail S3 Data Events : Analyzes object-level operations ( GetObject , PutObject ) to identify compromised credentials exfiltrating bulk data or attempting ransomware encryption.
Amazon VPC Flow Logs : Evaluates network connection metadata (IP addresses, ports, protocols, byte counts) to detect command-and-control (C2) communication, port scanning, and denial-of-service traffic.
Amazon Route 53 DNS Query Logs : Inspects DNS queries issued by EC2 instances to identify Domain Generation Algorithms (DGA), DNS data exfiltration, and communication with known malware domains.
Amazon EKS Audit Logs & Runtime Monitoring : Analyzes Kubernetes API control plane events and deploys an optional lightweight eBPF kernel agent to monitor host/container runtime activities.
Amazon RDS Login Activity : Monitors failed and anomalous database login attempts against Aurora, PostgreSQL, and MySQL databases.
Amazon EBS Malware Protection : Initiates automated, agentless malware scans on attached EBS volumes when GuardDuty detects suspicious EC2 behavior (e.g., cryptocurrency mining).
Finding Anatomy & Severity Scoring
GuardDuty findings follow a structured naming convention: [ThreatFamily] : [TargetResource] / [ThreatName] \text{[ThreatFamily]}:\text{[TargetResource]}/\text{[ThreatName]} [ThreatFamily] : [TargetResource] / [ThreatName]
Examples include CryptoCurrency:EC2/BitcoinTool.B!DNS and UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS .
Severity Tier Numerical Range Operational Meaning & Incident SLA
Low 1.0 – 3.9 Suspicious or unusual behavior detected; low immediate risk. Should be reviewed in daily security operations logs.
Medium 4.0 – 6.9 Suspicious activity observed (e.g., port scanning or API calls from an unusual location). Requires operational investigation within hours.
High 7.0 – 8.9 Resource is actively compromised (e.g., active cryptocurrency mining, C2 communication, or IAM credentials exfiltrated outside AWS). Requires immediate automated remediation .
Critical 9.0 – 10.0 An attack sequence is in progress or recently completed across multiple resources (GuardDuty Extended Threat Detection correlates related signals into one finding). Top triage priority — these frequently precede ransomware.
Amazon Inspector: Automated Vulnerability Management
Amazon Inspector is an automated vulnerability management service that continually scans AWS workloads for software vulnerabilities (Common Vulnerabilities and Exposures - CVEs) and unintended network exposure.
Modern Amazon Inspector vs. Inspector Classic
- Dimension Amazon Inspector Classic (Legacy) Modern Amazon Inspector
- Execution Model Scheduled assessments via standalone agent Continuous, automated, event-driven scanning
Agent Requirements Dedicated Inspector Classic Agent required Uses AWS Systems Manager (SSM) Agent or hybrid agentless snapshot scanning
Target Resources EC2 instances only EC2 instances, Amazon ECR container images, and AWS Lambda functions
ECR Container Scanning Basic scanning (OS packages only) on push or on demand Enhanced scanning on push + continuous re-scanning as new CVEs emerge
Risk Scoring Standard CVSS base score only Contextual Inspector Score factoring in real-world exploitability and network reachability
Contextual Risk Scoring Engine
Unlike traditional scanners that report raw CVSS base scores, Amazon Inspector computes a Contextual Inspector Score by correlating:
The Common Vulnerability Scoring System (CVSS) base metric.
Network Reachability : Evaluates VPC route tables, security groups, Internet Gateways, and Network ACLs to determine if the vulnerable package is accessible from the public internet.
Exploit Availability : Checks public exploit databases (such as CISA Known Exploited Vulnerabilities catalog) to determine if active exploit code exists in the wild.
If a vulnerability has a high CVSS base score but resides on an isolated private EC2 instance with no internet ingress and no active exploit code, Inspector downweights the score to prevent alert fatigue.
AWS Security Hub: Centralized Posture & Compliance Governance
AWS Security Hub provides a centralized security and compliance management center. It aggregates, normalizes, and prioritizes findings from GuardDuty, Inspector, Macie, IAM Access Analyzer, AWS Firewall Manager, and third-party partner products.
AWS Security Finding Format (ASFF)
Security Hub normalizes all ingested findings into a standard JSON schema known as AWS Security Finding Format (ASFF) . This enables DevOps engineers to build unified EventBridge routing rules regardless of which security service generated the finding. {
"SchemaVersion": "2016-11-21",
"Id": "arn:aws:securityhub:us-east-1:111122223333:subscription/cis-aws-foundations-benchmark/v/1.2.0/2.2/finding/ab12cd34",
- "ProductArn": "arn:aws:securityhub:us-east-1::product/aws/securityhub",
- "GeneratorId": "cis-aws-foundations-benchmark/v/1.2.0/2.2",
- "AwsAccountId": "111122223333",
"Types": ["Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark"],
- "FirstObservedAt": "2026-09-11T12:00:00Z",
- "Severity": {
- "Label": "HIGH",
- "Normalized": 70
- },
- "Title": "2.2 Ensure CloudTrail log file validation is enabled",
- "Description": "CIS Benchmark recommendation for verifying log integrity.",
- "Resources": [
- {
- "Type": "AwsCloudTrailTrail",
- "Id": "arn:aws:cloudtrail:us-east-1:111122223333:trail/main-trail",
- "Partition": "aws",
- "Region": "us-east-1"
- }
- ],
- "Compliance": {
- "Status": "FAILED"
- }
- }
- Automated Remediation Pipelines
DevOps teams automate remediation using Security Hub Custom Actions (manual trigger from console) or Amazon EventBridge Rules (fully automated real-time matching):
EventBridge Rule : Matches ASFF findings where ProductName is GuardDuty and Severity.Label is HIGH or CRITICAL .
Remediation Targets :
Compromised EC2 Instance : Lambda invokes ec2:ModifyInstanceAttribute to strip existing security groups and attach an isolated quarantine security group (no ingress, no egress), while triggering an SSM Automation runbook to capture a forensic memory dump and EBS snapshot.
Exfiltrated IAM Credentials : Lambda attaches an inline IAM policy to the compromised role with an explicit Deny for all API calls where aws:TokenIssueTime is earlier than the incident detection timestamp, neutralizing stolen temporary session tokens.
Vulnerable Container Image in Production : EventBridge invokes an AWS CodePipeline or GitHub Actions webhook to trigger a clean rebuild using patched base images.