What is Amazon GuardDuty?

GuardDuty is a threat detection service that continuously monitors your AWS accounts and workloads for malicious activity. It analyzes CloudTrail logs, VPC Flow Logs, and DNS logs using machine learning and threat intelligence. GuardDuty detects unauthorized access, compromised instances, and unusual API calls. It requires no infrastructure to manage — just enable it.