AWS GuardDuty

• A service provided by AWS that keep monitor the AWS account for threats.
• A threat detection tool for malicious activity using ML, anamoly detection and threat detection for potential security issues.
• Automatic monitoring for threats to AWS workloads

Examples:

• Compromised instancees: Instanes talking to unauhorized or malicious IP addresses.
• Unauthorized Access
• Malicious API activity