‫So now let's talk about Amazon GuardDuty.
‫GuardDuty helps you do intelligent threat discovery
‫to protect your AWS accounts.
‫How does it do it?
‫Well, it has machine learning algorithm, performs anomaly
‫detection and uses third party data to find these threats.
‫So to enable it, it's just one click.
‫Then you have a 30 days trial.
‫You don't need to install any software.
‫So GuardDuty is going to look at a lot of input data,
‫such as your CloudTrail event logs
‫to look for unusual API calls
‫or unauthorized deployments.
‫It's going to look at your management events
‫and your data events.
‫So for example, on the management side,
‫the create VPC Subnet event and so on,
‫whereas on the S3 data events
‫for example, get object, list objects, delete objects
‫and so on.
‫And then for VPC flow logs, it's going to look
‫at unusual internet traffic.
‫It's going to look at unusual IP addresses.
‫DNS logs to look at EC2 instances, sending encoded data
‫within DNS queries, which would mean they're compromised
‫and optional features to allow you to analyze, for example,
‫other input data sources such as your EKS audit logs,
‫your RDS and Aurora login events, your EBS, your Lambda
‫and your S3 data events.
‫So we can also set up EventBridge rules to
‫be notified automatically in case you have findings.
‫And then these rules can target whatever EventBridge
‫can target, such as AWS, Lambda, or SNS topics.
‫Also, this can come up in the exam.
‫GuardDuty is a very good tool to protect you
‫against cryptocurrency attacks
‫because there is a dedicated finding for it.
‫So it knows how to analyze all these input data
‫and find that there is a cryptocurrency attack.
‫So to summarize, within GuardDuty,
‫we have several input data.
‫We have the VPC flow logs,
‫the CloudTrail logs, and the DNS logs
‫that will be, no matter what, into GuardDuty
‫as well as some optional features you can enable,
‫such as your S3 logs, your EBS volumes,
‫your Lambda network activity, RDS and Aurora login activity
‫and your EKS logs and runtime monitoring as well
‫as most likely, more features over time
‫that I will not put here
‫because you get the idea of optional features.
‫And so from all these things,
‫then GuardDuty can generate findings
‫and if these findings are detected,
‫an event is created in Amazon EventBridge.
‫And therefore from EventBridge, thanks to rules,
‫we can trigger automations, for example,
‫using Lambda functions
‫or send notifications, for example, using SNS.
‫So that's it for this lecture.
‫I hope you liked it and I will see you in the next lecture.