15.3 Automated Threat Detection: GuardDuty, Inspector & Security Hub

Automated Threat Detection & Security Posture Architecture

Enterprise DevOps environments require real-time visibility into unauthorized behaviors, software vulnerabilities, and compliance drift across hundreds of accounts. AWS provides a coordinated triad of automated detection and posture management services:

[ Telemetry Sources: CloudTrail, VPC Flow, DNS, EKS, EBS ]
                           │
                           ▼
┌────────────────────────────────────────────────────────┐
│ Amazon GuardDuty (Behavioral Anomaly & Threat Intel)   │
└──────────────────────────┬─────────────────────────────┘
                           │
[ Compute Assets: EC2, ECR Containers, Lambda Functions ]
                           │
                           ▼
┌────────────────────────────────────────────────────────┐
│ Amazon Inspector (Continuous CVE Vulnerability Scans)  │
└──────────────────────────┬─────────────────────────────┘
                           │
                           ▼ Normalized ASFF Findings
┌────────────────────────────────────────────────────────┐
│ AWS Security Hub (Centralized Posture & Compliance)    │
│ • CIS AWS Foundations Benchmark • AWS FSBP • PCI-DSS   │
└──────────────────────────┬─────────────────────────────┘
                           │ Near-Real-Time Findings
                           ▼
┌────────────────────────────────────────────────────────┐
│ Amazon EventBridge (Event Pattern Matching)            │
└───────┬────────────────────────────────────────┬───────┘
        ▼                                        ▼
[ AWS Systems Manager Automation ]    [ AWS Lambda Remediation ]
(Quarantine SG / Snapshot Host)       (Revoke Stolen IAM Session)

---

Amazon GuardDuty: Intelligent Threat Detection

Amazon GuardDuty is a fully managed, serverless threat detection service that continuously monitors AWS accounts and workloads for malicious activity and unauthorized behavior. Crucially, GuardDuty is completely agentless and operates independently of customer compute resources, meaning it incurs zero performance overhead on running applications.

Telemetry Ingestion Streams

GuardDuty ingests massive volumes of operational telemetry directly from the underlying AWS service virtualization layer:

1. AWS CloudTrail Management Events: Monitors control plane API calls for unauthorized reconnaissance, privilege escalation, and console logins from Tor exit nodes.
2. AWS CloudTrail S3 Data Events: Analyzes object-level operations (GetObject, PutObject) to identify compromised credentials exfiltrating bulk data or attempting ransomware encryption.
3. Amazon VPC Flow Logs: Evaluates network connection metadata (IP addresses, ports, protocols, byte counts) to detect command-and-control (C2) communication, port scanning, and denial-of-service traffic.
4. Amazon Route 53 DNS Query Logs: Inspects DNS queries issued by EC2 instances to identify Domain Generation Algorithms (DGA), DNS data exfiltration, and communication with known malware domains.
5. Amazon EKS Audit Logs & Runtime Monitoring: Analyzes Kubernetes API control plane events and deploys an optional lightweight eBPF kernel agent to monitor host/container runtime activities.
6. Amazon RDS Login Activity: Monitors failed and anomalous database login attempts against Aurora, PostgreSQL, and MySQL databases.
7. Amazon EBS Malware Protection: Initiates automated, agentless malware scans on attached EBS volumes when GuardDuty detects suspicious EC2 behavior (e.g., cryptocurrency mining).

Finding Anatomy & Severity Scoring

GuardDuty findings follow a structured naming convention:

$\text{[ThreatFamily]}:\text{[TargetResource]}/\text{[ThreatName]}$

Examples include CryptoCurrency:EC2/BitcoinTool.B!DNS and UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS.

---

Amazon Inspector: Automated Vulnerability Management

Amazon Inspector is an automated vulnerability management service that continually scans AWS workloads for software vulnerabilities (Common Vulnerabilities and Exposures - CVEs) and unintended network exposure.

Modern Amazon Inspector vs. Inspector Classic

Contextual Risk Scoring Engine

Unlike traditional scanners that report raw CVSS base scores, Amazon Inspector computes a Contextual Inspector Score by correlating:

• The Common Vulnerability Scoring System (CVSS) base metric.
• Network Reachability: Evaluates VPC route tables, security groups, Internet Gateways, and Network ACLs to determine if the vulnerable package is accessible from the public internet.
• Exploit Availability: Checks public exploit databases (such as CISA Known Exploited Vulnerabilities catalog) to determine if active exploit code exists in the wild.

If a vulnerability has a high CVSS base score but resides on an isolated private EC2 instance with no internet ingress and no active exploit code, Inspector downweights the score to prevent alert fatigue.

---

AWS Security Hub: Centralized Posture & Compliance Governance

AWS Security Hub provides a centralized security and compliance management center. It aggregates, normalizes, and prioritizes findings from GuardDuty, Inspector, Macie, IAM Access Analyzer, AWS Firewall Manager, and third-party partner products.

AWS Security Finding Format (ASFF)

Security Hub normalizes all ingested findings into a standard JSON schema known as AWS Security Finding Format (ASFF). This enables DevOps engineers to build unified EventBridge routing rules regardless of which security service generated the finding.

{
  "SchemaVersion": "2016-11-21",
  "Id": "arn:aws:securityhub:us-east-1:111122223333:subscription/cis-aws-foundations-benchmark/v/1.2.0/2.2/finding/ab12cd34",
  "ProductArn": "arn:aws:securityhub:us-east-1::product/aws/securityhub",
  "GeneratorId": "cis-aws-foundations-benchmark/v/1.2.0/2.2",
  "AwsAccountId": "111122223333",
  "Types": ["Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark"],
  "FirstObservedAt": "2026-09-11T12:00:00Z",
  "Severity": {
    "Label": "HIGH",
    "Normalized": 70
  },
  "Title": "2.2 Ensure CloudTrail log file validation is enabled",
  "Description": "CIS Benchmark recommendation for verifying log integrity.",
  "Resources": [
    {
      "Type": "AwsCloudTrailTrail",
      "Id": "arn:aws:cloudtrail:us-east-1:111122223333:trail/main-trail",
      "Partition": "aws",
      "Region": "us-east-1"
    }
  ],
  "Compliance": {
    "Status": "FAILED"
  }
}

Automated Remediation Pipelines

DevOps teams automate remediation using Security Hub Custom Actions (manual trigger from console) or Amazon EventBridge Rules (fully automated real-time matching):

1. EventBridge Rule: Matches ASFF findings where ProductName is GuardDuty and Severity.Label is HIGH or CRITICAL.
2. Remediation Targets:
   • Compromised EC2 Instance: Lambda invokes ec2:ModifyInstanceAttribute to strip existing security groups and attach an isolated quarantine security group (no ingress, no egress), while triggering an SSM Automation runbook to capture a forensic memory dump and EBS snapshot.
   • Exfiltrated IAM Credentials: Lambda attaches an inline IAM policy to the compromised role with an explicit Deny for all API calls where aws:TokenIssueTime is earlier than the incident detection timestamp, neutralizing stolen temporary session tokens.
   • Vulnerable Container Image in Production: EventBridge invokes an AWS CodePipeline or GitHub Actions webhook to trigger a clean rebuild using patched base images.