Cloud › Module 4 › Lesson 3
GuardDuty Named
GuardDuty named literacy covers threat detection findings — unusual API, credential exfil patterns, recon — triage context on YOUR $CLOUD_LAB.
Visual · t31_guardduty_named
GuardDuty literacy. $CLOUD_LAB only. Original Cyberlium.
Opening
Managed detection for AWS — literacy reads finding types and ties them to IAM and trail evidence on sandboxes you own.
Amazon GuardDuty analyzes CloudTrail, VPC Flow Logs, and DNS logs for threats: UnauthorizedAccess IAM finding, Recon EC2 port probe, S3 anomaly patterns, cryptocurrency mining indicators. Findings have severity, type, affected resource, and remediation hints — defenders correlate with CloudTrail and IAM, not panic-disable on first low finding. Cyberlium names GuardDuty finding classes on YOUR $CLOUD_LAB — sample finding cards from courseware or fictional examples. Next: AWS Data Lab.
1. GuardDuty finding classes (named)
UnauthorizedAccess:API: unusual API from new geo or TOR. Stealth:IAMUser/CloudTrailLoggingDisabled: trail tampering signal. Recon:EC2/PortProbeUnprotectedPort: world-exposed port scanned. S3 findings: anomalous API on bucket.
On $CLOUD_LAB, write triage card for one fictional GuardDuty finding — severity, evidence sources, first three steps.
Command guide
Try these commands — GuardDuty finding classes (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
GuardDuty — https://docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html GuardDuty findings — https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_findings.html AWS Security Hub — https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export CLOUD_LAB=${CLOUD_LAB:-$HOME/cyberlium-lab/t31-cloud}
curl -sS https://docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html | head -10
cat > "$CLOUD_LAB/aws/guardduty-named-literacy.txt" <<'EOF'
GuardDuty literacy (YOUR account — named, no stranger org scans):
Finding types: UnauthorizedAccess, Recon, Trojan, CryptoCurrency
Data sources: CloudTrail, VPC Flow Logs, DNS logs, S3 logs, EKS audit
Response: triage finding → correlate CloudTrail → containment in YOUR account
CSPM complement: GuardDuty = threat detection; config rules = misconfig
Enable in YOUR account sandbox — never enable against unauthorized accounts
EOFCommand — copy this
grep -E 'GuardDuty|YOUR account|never' "$CLOUD_LAB/aws/guardduty-named-literacy.txt"
Primary tools to practice this lesson: grep, curl. Reference sites: GuardDuty (https://docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html); GuardDuty findings (https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_findings.html); AWS Security Hub (https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why GuardDuty complements CloudTrail
Raw trails overwhelm analysts — GuardDuty applies AWS threat intel and ML. Triage still needs scope: confirm account is yours, pull CloudTrail event ID, check IAM key inventory.
Students practice finding vocabulary on lab cards — not simulate attacks on stranger accounts to generate findings.
3. Literacy ≠ attack-to-generate-findings
Forbidden: running recon against stranger AWS to 'test GuardDuty.' Allowed: GuardDuty named card — three finding types with defender triage on $CLOUD_LAB.
Ship: GuardDuty triage card for YOUR lab scenario. Next: AWS Data Lab.
4. What you ship: GuardDuty triage card for $CLOUD_LAB
Finding type, severity, evidence sources, triage steps. $CLOUD_LAB named. NO stranger attacks. chmod 600.
5. What you record before the next lesson
Date. GuardDuty card. $CLOUD_LAB named. File t31-m04-l03-guardduty-named.txt chmod 600.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Probe stranger EC2 to generate findings. Disable GuardDuty on first low alert.
Right
Write GuardDuty triage card for YOUR $CLOUD_LAB scenario. Next: AWS Data Lab.
Mission: triage fictional GuardDuty finding
1) Pick one finding type from lesson. 2) List CloudTrail and IAM evidence to pull. 3) Write three triage steps on YOUR account. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Trail tampering findings are P1 — verify logging before deep IAM hunt.
Knowledge Check
APPLY: GuardDuty analyzes primarily:
Multiple choice
Knowledge Check
APPLY: True or False: GuardDuty findings should correlate with CloudTrail and IAM evidence.
True or False
Knowledge Check
APPLY: GuardDuty literacy on Cyberlium avoids:
Multiple choice