The security team wants to detect compromised credentials and signs of cryptocurrency mining.
It needs continuous analysis for suspicious activity.
Which AWS service is primarily used?
Amazon GuardDuty continuously analyzes AWS data sources and logs to detect threats and produce findings for investigation.
Detailed explanation
Config evaluates resource configuration and does not serve as the primary threat-detection engine.
Config evaluates resource configuration and does not serve as the primary threat-detection engine.
GuardDuty continuously analyzes relevant data sources and generates findings for suspicious activity such as compromised credentials.
GuardDuty continuously analyzes relevant data sources and generates findings for suspicious activity such as compromised credentials.
Inspector focuses on software vulnerabilities and network exposure rather than threat-intelligence detection of account activity.
Inspector focuses on software vulnerabilities and network exposure rather than threat-intelligence detection of account activity.
Artifact provides AWS compliance documents, not account-specific threat findings.
Artifact provides AWS compliance documents, not account-specific threat findings.
Check official documentation
Compare the following points with the official documentation.
Amazon GuardDuty User GuideのWhat is Amazon GuardDuty?を確認する。
What to confirm
GuardDutyが疑わしい活動をfindingとして生成し、調査・対応の起点になる。
Key points
- Amazon GuardDuty
- Threat detection
- Finding
Notes
- Environment: AWS公式GuardDutyドキュメントの確認
- Confirm current service capabilities and compliance guidance in the official AWS documentation.
Foundation review
Continuous analysis
GuardDuty looks for suspicious patterns across relevant data sources.
Finding-driven response
A finding supplies an investigation and response starting point rather than automatically fixing every issue.