GuardDuty, CloudTrail Insights, and AWS Detective

So far we've covered the raw evidence sources — CloudTrail, VPC flow logs, S3 logs. Now we look at the tools AWS provides that sit on top of all that telemetry and do the detection work for you. These three services form AWS's native automated detection and investigation stack.

Choosing the Right Tool for the Job

▸ CloudTrail Insights (statistical anomaly) → GuardDuty (ML threat detection) → AWS Detective (investigation platform)

None of these replace manual CloudTrail analysis. They are the triage layer — they surface the needles so you can investigate.

CloudTrail Insights — Statistical Anomaly Detection

CloudTrail Insights is an optional feature you enable on a CloudTrail trail. It analyses your management events and builds a statistical model of 'normal' API activity volumes. When activity spikes significantly above or below those baselines, it generates an Insight event.

Example: your environment normally sees about 50 IAM API calls per hour. A credential stuffing attack or compromised admin account suddenly generates 2,400 IAM calls in 10 minutes. CloudTrail Insights will flag this as anomalous — even if every individual API call is legitimate in isolation.

CloudTrail Insights generates two types of findings:

• API call rate anomalies — unusual volume of calls to a specific API in a short window.

• API error rate anomalies — unusual number of access denied or throttled errors, which often indicates reconnaissance or brute forcing.

💡 IR Tip: CloudTrail Insights is particularly good at catching automated attacks — scripts running API enumeration, bulk key creation, or mass resource modification. Human attackers doing things manually are harder for statistical models to catch because their rate is lower. This is where GuardDuty's ML approach adds value.

Pricing: $0.35 per 100,000 events analysed. For most mid-sized environments, this is less than $5/month.

GuardDuty — Intelligent Threat Detection

GuardDuty is AWS's primary threat detection service. It continuously analyses CloudTrail management events, VPC flow logs, and DNS logs across your entire AWS account and organisation, using a combination of machine learning models and threat intelligence feeds to identify attack patterns.

Unlike CloudTrail Insights which detects statistical anomalies, GuardDuty knows what attacks look like. Its threat intelligence includes: known malicious IP addresses (Tor nodes, known C2 servers, commercial threat intel feeds), known crypto mining pool addresses, known command-and-control domains.

GuardDuty finding categories: UnauthorizedAccess (account takeover, credential abuse), Recon (reconnaissance API calls), Trojan (malware indicators), CryptoCurrency (mining activity), Backdoor (reverse shells, C2), Stealth (log tampering, trail deletion), Discovery (resource enumeration), Exfiltration (data movement), PenTest (common pentesting tools detected).

Severity levels:

• LOW (informational, usually benign),

• MEDIUM (investigate when you have time),

• HIGH (investigate immediately — active threat),

• CRITICAL (rare, immediate action required).

Pricing: based on data volume processed. Roughly $1-5/month for small accounts, scales to hundreds of dollars for large enterprise environments. There's a 30-day free trial when you first enable it.

⚡ Update (2024): GuardDuty has significantly expanded its detector types. New in 2023-2024: EC2 Runtime Monitoring (agent-based detection of suspicious OS-level activity on EC2), RDS Protection (anomalous database login detection), Lambda Protection (threat detection in serverless functions), EKS Runtime Monitoring (container escape, suspicious kubectl activity). These require explicit opt-in and some require deploying an agent.

AWS Detective — Investigation Platform

AWS Detective is a separate service that builds a graph-based analysis layer on top of CloudTrail logs, VPC flow logs, and GuardDuty findings.

Where GuardDuty tells you 'this looks suspicious', Detective helps you investigate why it's suspicious and what the full scope is.

Detective continuously ingests and normalises your environment data (up to a year of history) and uses graph ML to map relationships between: IAM entities (users, roles, accounts), API calls, IP addresses, resource access patterns, and GuardDuty findings.

Key Detective capabilities: Entity profiles (full activity history for any IAM user, role, or IP), Behaviour profiles (what's normal for this entity — detection surface mapped visually), Finding groups (clustering related GuardDuty findings into a single investigation thread), Cross-account investigation (if you have AWS Organizations, Detective can show activity across all accounts in your org).

💡 IR Tip: Start every GuardDuty finding investigation in Detective. The entity profile for the affected IAM user or role will immediately show you the full scope — every API call, every IP, every resource touched — across your retention window. This context is what turns a 2-hour investigation into a 20-minute one.

When to Use Which Tool

• CloudTrail Insights → 'Alert me when API call volumes spike unexpectedly'

• GuardDuty → 'Detect known attack patterns, malicious IPs, and anomalous behaviours continuously'

• AWS Detective → 'Investigate a specific alert and understand the full scope and context'

• Manual CloudTrail querying (Athena) → 'Hunt for something specific that automated tools haven't surfaced'

These tools are not mutually exclusive — the ideal AWS security posture uses all of them in combination.

---------------------------------------------------------------------------------------------------------

What's Next

Next Article covers event-driven DFIR automation — Lambda, Step Functions, and EventBridge. How to build automated response workflows that kick off the moment GuardDuty or CloudTrail Insights triggers an alert.

-------------------------------------------------Dean-----------------------------------------