What data does GuardDuty analyse and how do you respond to findings automatically?
Quick Answer
It continuously analyses CloudTrail management and S3 data events, VPC Flow Logs and DNS logs (plus EKS audit logs and EBS malware scanning via add-ons) using ML and threat intel — no agents or log shipping to set up.
Detailed Answer
It continuously analyses CloudTrail management and S3 data events, VPC Flow Logs and DNS logs (plus EKS audit logs and EBS malware scanning via add-ons) using ML and threat intel — no agents or log shipping to set up. Findings (crypto-mining, credential exfiltration, anomalous API calls) go to EventBridge, so you auto-respond: isolate an instance's security group, disable a suspected-compromised IAM key, or page on-call. Suppression rules cut known-benign noise.
Code Example
# Deep-dive: AWS GuardDuty # ML/threat-intel detection over CloudTrail, VPC Flow Logs and DNS logs, EKS and Malware Protection add-ons, finding types and severities, suppression rules to cut noise, and automated response via EventBridge and Lambda # apply the reasoning in the detailed answer to your own pipeline, # and prove it with a test/dry-run before enforcing in production
Interview Tip
This is where depth shows — be concrete about AWS GuardDuty, not generic about "security".