Intermediate LevelCloud Computing (AWS/GCP/Azure)
What is Amazon GuardDuty and how does it detect malicious account activity using machine learning?
❓ Interview Prompt: Explain Amazon GuardDuty threat detection, continuous log ingestion (CloudTrail, VPC Flow Logs, DNS), and automated remediation.
Amazon GuardDuty is an intelligent threat detection service that continuously monitors your AWS accounts and workloads for malicious activity.
Ingestion & Analysis:
•
Operates out-of-band with zero agent installation or impact on workload performance.
•
Analyzes billions of events across AWS CloudTrail Logs, VPC Flow Logs, DNS Logs, EKS Audit Logs, and S3 Data Events.
•
Uses Machine Learning and Anomaly Detection to flag compromised EC2 instances (bitcoin mining, C2 communication), leaked IAM access keys, or unauthorized S3 data exfiltration.
Code Implementation Example
typescript
// Automated GuardDuty Finding Remediation via EventBridge & Lambda
export const handler = async (event: any) => {
const finding = event.detail;
if (finding.type === 'UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration') {
console.warn("GUARDDUTY ALERT: Leaked IAM credentials detected! Revoking session keys...");
await iam.revokeUserAccessKeys(finding.resource.accessKeyDetails.accessKeyId);
}
};💡Automated remediation Lambda handler responding to GuardDuty security findings.
🎯 Interview Key Takeaway
Amazon GuardDuty uses machine learning to analyze CloudTrail, VPC Flow Logs, and DNS events for malicious threat detection.
#GuardDuty#Security#Threat Detection#Machine Learning#Intermediate
Back to all Cloud Computing (AWS/GCP/Azure) Questions→