Amazon GuardDuty

Continuous threat detection over AWS logs, producing security findings for suspicious activity.

Provider: aws
Kind: Monitoring
Category: Operations
Official docs: https://docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html

Properties · 6 set by this component

property	type	values	required	kind default	this component
alertGrouping	boolean	—	no	false	▸ true
collectorMode	enum	pull \| push	no	pull	▸ pull
extendedThreatDetection · component property	boolean	—	no	true	inherited
findingAggregationHours · component property	integer	—	no	6	inherited
foundationalDataSources · component property	boolean	—	no	true	inherited
independentOfMonitored	boolean	—	no	false	▸ false
managed	boolean	—	no	false	▸ true
organizationWide · component property	boolean	—	no	false	inherited
retentionDays	integer	—	no	—	▸ 90
runtimeMonitoring · component property	boolean	—	no	false	inherited
signal	enum	metrics \| logs \| traces \| alerts \| all	no	metrics	▸ alerts

Rules that apply · 0

Every rule whose selector covers this component's kind or its category. Whether a rule fires depends on the design: its properties, its edges and its groups.

No rule reads this kind yet. That is a gap, not a guarantee.

Use it in a design

nodes:
  - { id: "guardduty", component: "aws-guardduty" }

Other Monitoring products · 174

and 134 more → Monitoring page

Source

1# yaml-language-server: $schema=../../schema/component.schema.json
2# Amazon GuardDuty: continuous threat detection over AWS logs. "What is Amazon GuardDuty?": on
3# enablement it automatically ingests the foundational data sources (CloudTrail management events,
4# VPC flow logs, DNS logs), Extended Threat Detection is on at no cost, and every protection plan
5# except Runtime Monitoring is enabled on first activation. "Processing GuardDuty findings with
6# Amazon EventBridge": findings are stored for 90 days and repeat occurrences are aggregated into
7# one event per 6-hour interval by default.
8schemaVersion: "1"
9type: "component"
10id: "aws-guardduty"
11kind: "monitoring"
12provider: "aws"
13docs: "https://docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html"
14defaults:
15  signal: "alerts"
16  collectorMode: "pull"
17  alertGrouping: true
18  retentionDays: 90
19  independentOfMonitored: false
20  managed: true
21properties:
22  foundationalDataSources:
23    type: "boolean"
24    default: true
25  extendedThreatDetection:
26    type: "boolean"
27    default: true
28  findingAggregationHours:
29    type: "integer"
30    default: 6
31  runtimeMonitoring:
32    type: "boolean"
33    default: false
34  organizationWide:
35    type: "boolean"
36    default: false

The same page as markdown, for an agent: /catalogue/components/aws-guardduty.md