Security Assessment & Threat Detection

Quick Navigation

1. Amazon GuardDuty

GuardDuty is a regional, agentless threat detection service that continuously analyzes data sources already being produced by your AWS account. You enable it with a single API call and it starts producing security findings within minutes. There is nothing to install, no log pipelines to configure, and it does not sit in the data path so it cannot affect latency or availability.

Data Sources

GuardDuty ingests several foundational data sources automatically. You do not enable these yourself, GuardDuty subscribes to them on your behalf and analyzes them with ML models and threat intelligence feeds.

Finding Types and Severity

Every GuardDuty finding has a type in the format ThreatPurpose:ResourceType/ThreatFamilyNameand a severity score from 1.0 to 10.0. Low (1-3.9), Medium (4-6.9), High (7-8.9), and Critical (9-10) map directly to how urgently you should investigate.

Enable GuardDuty

# Enable GuardDuty in the current region
aws guardduty create-detector \
  --enable \
  --finding-publishing-frequency FIFTEEN_MINUTES

# Confirm the detector is active
aws guardduty list-detectors

{
    "DetectorId": "abc123def456abc123def456abc123de"
}
["abc123def456abc123def456abc123de"]

List and Retrieve Findings

DETECTOR="abc123def456abc123def456abc123de"

# List all active findings for this detector
aws guardduty list-findings \
  --detector-id "$DETECTOR" \
  --finding-criteria '{"Criterion": {"service.archived": {"Eq": ["false"]}}}'

# Fetch the details of specific findings
aws guardduty get-findings \
  --detector-id "$DETECTOR" \
  --finding-ids "finding-id-1" "finding-id-2"

{
    "FindingIds": [
        "1ab12abc1ab12ab12ab1234567890abc",
        "2bc23bcd2bc23bc23bc2345678901bcd"
    ]
}

Query High-Severity Findings with boto3

import boto3

gd = boto3.client("guardduty", region_name="us-east-1")
detector_id = gd.list_detectors()["DetectorIds"][0]

# Fetch HIGH and CRITICAL severity findings (7.0 = High, 9.0 = Critical)
paginator = gd.get_paginator("list_findings")
pages = paginator.paginate(
    DetectorId=detector_id,
    FindingCriteria={
        "Criterion": {
            "severity": {"Gte": 7},            # >= 7.0 catches both High and Critical
            "service.archived": {"Eq": ["false"]},
        }
    },
    SortCriteria={"AttributeName": "severity", "OrderBy": "DESC"},
)
ids = [fid for page in pages for fid in page["FindingIds"]]

if ids:
    findings = gd.get_findings(DetectorId=detector_id, FindingIds=ids[:10])
    for f in findings["Findings"]:
        print(f["Type"], "|", f["Severity"], "|", f["Region"])
else:
    print("No high-severity findings")

UnauthorizedAccess:EC2/SSHBruteForce | 7.0 | us-east-1
Recon:EC2/PortProbeUnprotectedPort | 8.0 | us-east-1

Route Findings to SNS via EventBridge

GuardDuty publishes every finding to EventBridge automatically. Create a rule that matches high-severity findings and routes them to SNS for immediate email or Slack notification, or to a Lambda for automated remediation such as isolating a compromised EC2 instance.

# Create a rule that fires whenever GuardDuty produces a HIGH finding
aws events put-rule \
  --name "GuardDuty-High-Findings" \
  --event-pattern '{
    "source": ["aws.guardduty"],
    "detail-type": ["GuardDuty Finding"],
    "detail": {
      "severity": [{"numeric": [">=", 7]}]
    }
  }' \
  --state ENABLED

# Attach an SNS topic as the target to receive email notifications
aws events put-targets \
  --rule "GuardDuty-High-Findings" \
  --targets '[{
    "Id": "SnsTopic",
    "Arn": "arn:aws:sns:us-east-1:123456789012:security-alerts"
  }]'

Suppression Rules

Suppression rules automatically archive findings that match specific criteria, reducing noise from expected activity. A common use case is suppressing SSH brute-force findings from known bastion host IP addresses in your on-premises range.

DETECTOR="abc123def456abc123def456abc123de"

# Create a suppression rule to silence low-severity SSH probes
# from known bastion host IP ranges
aws guardduty create-filter \
  --detector-id "$DETECTOR" \
  --name "SuppressKnownBastionSSH" \
  --action ARCHIVE \
  --finding-criteria '{
    "Criterion": {
      "type": {"Eq": ["UnauthorizedAccess:EC2/SSHBruteForce"]},
      "service.action.networkConnectionAction.remoteIpDetails.ipAddressV4": {
        "Eq": ["10.0.0.50", "10.0.0.51"]
      }
    }
  }'

2. Amazon Inspector

Inspector v2 is a continuous vulnerability management service. Where GuardDuty detects what an attacker is doing, Inspector tells you what vulnerabilities exist that an attacker could exploit. It correlates the packages installed on your workloads against the National Vulnerability Database (NVD) and AWS threat intelligence, then prioritizes findings by reachability from the internet, not just CVSS score alone.

What Inspector Scans

The Inspector Score

The Inspector Score (0-10) is not the raw CVSS score. Inspector adjusts the base CVSS score using contextual factors specific to your environment. A CVE on an EC2 instance with port 443 open to 0.0.0.0/0 and no security group restriction gets a higher score than the same CVE on an instance reachable only from inside a private subnet.

Enable Inspector v2

# Enable Inspector v2 for EC2, ECR, and Lambda scanning
aws inspector2 enable \
  --resource-types EC2 ECR LAMBDA

{
    "accounts": [
        {
            "accountId": "123456789012",
            "resourceStatus": {
                "ec2": "ENABLING",
                "ecr": "ENABLING",
                "lambda": "ENABLING"
            },
            "status": "ENABLING"
        }
    ],
    "failedAccounts": []
}

List Critical and High Findings

# List CRITICAL and HIGH findings across all resource types
aws inspector2 list-findings \
  --filter-criteria '{
    "severity": [
      {"comparison": "EQUALS", "value": "CRITICAL"},
      {"comparison": "EQUALS", "value": "HIGH"}
    ],
    "findingStatus": [{"comparison": "EQUALS", "value": "ACTIVE"}]
  }' \
  --sort-criteria '{"field": "INSPECTOR_SCORE", "sortOrder": "DESC"}' \
  --max-results 10

{
    "findings": [
        {
            "findingArn": "arn:aws:inspector2:us-east-1:...",
            "title": "CVE-2023-44487 - HTTP/2 Rapid Reset Attack",
            "severity": "CRITICAL",
            "inspectorScore": 9.8,
            "resources": [{"type": "AWS_EC2_INSTANCE", "id": "i-0abc123..."}],
            "packageVulnerabilityDetails": {
                "cvss": [{"baseScore": 7.5, "scoringVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],
                "vulnerabilityId": "CVE-2023-44487"
            },
            "status": "ACTIVE"
        }
    ]
}

Aggregate Findings by Type with boto3

import boto3

ins = boto3.client("inspector2", region_name="us-east-1")

# Aggregate finding counts by resource type and severity
response = ins.list_finding_aggregations(
    aggregationType="FINDING_TYPE",
    aggregationRequest={
        "findingTypeAggregation": {
            "sortBy": "CRITICAL",
            "sortOrder": "DESC",
        }
    },
)
for item in response["responses"]:
    agg = item["findingTypeAggregation"]
    print(
        agg["findingType"],
        "- Critical:", agg.get("severityCounts", {}).get("critical", 0),
        "| High:", agg.get("severityCounts", {}).get("high", 0),
    )

PACKAGE_VULNERABILITY - Critical: 4 | High: 17
NETWORK_REACHABILITY - Critical: 0 | High: 3
CODE_VULNERABILITY - Critical: 1 | High: 2

Enable Continuous ECR Scanning

Setting the registry scanning configuration to ENHANCED with CONTINUOUS_SCANmeans Inspector re-evaluates every image already in your repository whenever a new CVE is published, not just on push. This is essential for catching vulnerabilities disclosed after an image was built.

# Enable continuous scanning when an image is pushed to ECR
aws ecr put-registry-scanning-configuration \
  --scan-type ENHANCED \
  --rules '[{
    "repositoryFilters": [{"filter": "*", "filterType": "WILDCARD"}],
    "scanFrequency": "CONTINUOUS_SCAN"
  }]'

# Check the current scan findings for a specific image
aws inspector2 list-findings \
  --filter-criteria '{
    "ecrImageRepositoryName": [{"comparison": "EQUALS", "value": "my-app"}],
    "findingStatus": [{"comparison": "EQUALS", "value": "ACTIVE"}]
  }'

3. Amazon Macie

Macie is a data security service focused entirely on S3. It uses machine learning and pattern matching to automatically discover and classify sensitive data stored in your buckets: personally identifiable information (PII), financial data, credentials, and PHI. Beyond data classification, Macie continuously evaluates your S3 bucket policies and settings and raises Policy findings for misconfigurations such as publicly accessible buckets, disabled encryption, or objects shared with external AWS accounts.

Finding Types

Automated Discovery vs Classification Jobs

Enable Macie

# Enable Macie in the current region
aws macie2 enable-macie

# Confirm the session is active and check coverage status
aws macie2 get-macie-session

{
    "createdAt": "2026-06-10T10:00:00Z",
    "findingPublishingFrequency": "FIFTEEN_MINUTES",
    "serviceRole": "arn:aws:iam::123456789012:role/aws-service-role/macie.amazonaws.com/...",
    "status": "ENABLED",
    "updatedAt": "2026-06-10T10:00:00Z"
}

Enable Automated Discovery and Run a Classification Job

# Enable automated sensitive data discovery - Macie continuously samples
# objects across all S3 buckets and classifies sensitive data types
aws macie2 update-automated-discovery-configuration \
  --status ENABLED

# Run a targeted one-time job on specific buckets for a full deep scan
aws macie2 create-classification-job \
  --job-type ONE_TIME \
  --name "prod-data-lake-full-scan" \
  --s3-job-definition '{
    "bucketDefinitions": [
      {
        "accountId": "123456789012",
        "buckets": ["prod-data-lake", "app-user-uploads", "analytics-export"]
      }
    ]
  }'

Query Sensitive Data Findings with boto3

import boto3

macie = boto3.client("macie2", region_name="us-east-1")

# Fetch SensitiveData findings sorted by severity score
paginator = macie.get_paginator("list_findings")
pages = paginator.paginate(
    FindingCriteria={
        "criterion": {
            "category": {"eq": ["SENSITIVE_DATA"]},
        }
    },
    SortCriteria={"attributeName": "severity.score", "orderBy": "DESC"},
)
ids = [fid for page in pages for fid in page["findingIds"]]

if ids:
    result = macie.get_findings(findingIds=ids[:10])
    for f in result["findings"]:
        category = (
            f["sensitiveData"][0]["category"] if f.get("sensitiveData") else "n/a"
        )
        bucket = f["resourcesAffected"]["s3Bucket"]["name"]
        print(f["title"], "|", category, "|", bucket)
else:
    print("No sensitive data findings")

Sensitive data in S3 object | CREDENTIALS | prod-data-lake
Sensitive data in S3 object | PERSONAL_INFORMATION | app-user-uploads
Sensitive data in S3 object | FINANCIAL_INFORMATION | analytics-export

List Policy Findings (Bucket Misconfigurations)

# List Policy findings - bucket misconfigurations (public access, no encryption, external sharing)
aws macie2 list-findings \
  --finding-criteria '{
    "criterion": {
      "category": {"eq": ["POLICY"]},
      "severity.description": {"eq": ["High", "Critical"]}
    }
  }'

# Get details on a specific Policy finding
aws macie2 get-findings \
  --finding-ids "a1b2c3d4-e5f6-7890-abcd-ef1234567890"

4. Amazon Detective

Detective is not a threat detection service, it is a threat investigation service. Where GuardDuty tells you that something suspicious happened, Detective helps you understand why it happened, what else the affected entity did, and how far the compromise has spread. It automatically ingests CloudTrail logs, VPC Flow Logs, and GuardDuty findings and uses machine learning to build a behavior graph: an interactive model of how every IAM principal, EC2 instance, S3 bucket, and IP address in your account relates and behaves over time.

How Detective Works

Enable Amazon Detective

# Enable Amazon Detective - creates a behavior graph in the current region
aws detective create-graph

# Confirm the behavior graph is active
aws detective list-graphs

{
    "GraphArn": "arn:aws:detective:us-east-1:123456789012:graph:abc123def456abc123def456abc123de"
}
{
    "GraphList": [
        {
            "Arn": "arn:aws:detective:us-east-1:123456789012:graph:abc123def456abc123def456abc123de",
            "CreatedTime": "2026-06-10T10:00:00Z"
        }
    ]
}

Start an Investigation on an IAM Entity

When a GuardDuty finding names a specific IAM user or role, you can open a scoped investigation that evaluates that entity's behavior across the time window you specify. Detective scores the entity's activity against its baseline and surfaces the indicators most likely to confirm or refute the finding.

GRAPH="arn:aws:detective:us-east-1:123456789012:graph:abc123def456abc123def456abc123de"

# Start an investigation on a specific IAM entity over a time window.
# Use this after GuardDuty raises a finding against an IAM user or role.
aws detective start-investigation \
  --graph-arn "$GRAPH" \
  --entity-arn "arn:aws:iam::123456789012:user/alice" \
  --scope-start-time "2026-06-01T00:00:00Z" \
  --scope-end-time "2026-06-10T23:59:59Z"

# Poll for results once the investigation is complete (RUNNING -> SUCCESSFUL)
aws detective get-investigation \
  --graph-arn "$GRAPH" \
  --investigation-id "invest-abc123"

List Finding Groups with boto3

import boto3

det = boto3.client("detective", region_name="us-east-1")
graph_arn = det.list_graphs()["GraphList"][0]["Arn"]

# List finding groups - correlated GuardDuty findings forming an attack campaign
response = det.list_finding_groups(
    GraphArn=graph_arn,
    Filter={
        "CreatedTime": {
            "StartInclusive": "2026-06-01T00:00:00Z",
            "EndInclusive": "2026-06-10T23:59:59Z",
        }
    },
)
for fg in response.get("FindingGroups", []):
    print(fg["Id"], "|", fg["Severity"], "|", fg["CreatedTime"])

fg-001a2b3c4d5e6f | HIGH    | 2026-06-09T14:22:01Z
fg-007f8e9d0c1b2a | MEDIUM  | 2026-06-08T09:47:33Z

5. Service Comparison

GuardDuty, Inspector, and Macie solve different but complementary security problems. In production you should run all three: one detects active threats, one closes attack surface before exploitation, and one ensures sensitive data is classified and protected at rest.

6. Security Hub