Managing Amazon GuardDuty findings - Amazon GuardDuty

Managing Amazon GuardDuty findings

GuardDuty offers several important features to help you sort, store, and manage your findings. These features will help you tailor findings to your specific environment, reduce noise from low value findings, and help you focus on threats to your unique AWS environment. Review the topics on this page to understand how you can use these features to increase the value of GuardDuty's findings.


Summary dashboard

Learn about the components of the summary dashboard available in the GuardDuty console.

Filtering findings

Learn how to filter GuardDuty findings based on criteria you specify.

Suppression rules

Learn how to automatically filter the findings GuardDuty alerts you to through suppression rules. Suppression rules automatically archive findings based on filters.

Working with trusted IP lists and threat lists

Customize the GuardDuty monitoring scope using IP Lists and Threat Lists based on publicly-routable IP addresses. Trusted IP lists prevent non-DNS findings from being generated from IP's you consider trusted, while Threat Intel Lists will cause GuardDuty to alert you of activity from user-defined IPs.

Exporting findings

Configure automatic exporting of your findings to an S3 Bucket so you can maintain records past 90-day findings retention period. This historical data can be used to track suspicious activity in your account and help you evaluate whether your remediation actions were successful.

Creating custom responses to GuardDuty findings with Amazon CloudWatch Events

Set up automatic notifications for GuardDuty findings through Amazon CloudWatch events. You can also automate other tasks through CloudWatch Events to help you respond to findings.

Understanding CloudWatch Logs and reasons for skipping resources during Malware Protection scan

Learn how you can audit the CloudWatch Logs for GuardDuty Malware Protection and what are the reasons because of which your impacted Amazon EC2 instance or Amazon EBS volumes may have been skipped during the scanning process.

Reporting false positives in GuardDuty Malware Protection

Learn about the false positive experience in GuardDuty Malware Protection and how you can report false positive threat detections.