What is AWS GuardDuty?

Amazon GuardDuty is a threat detection service that continuously monitors your AWS accounts and workloads for malicious activity and delivers detailed security findings for visibility and remediation. GuardDuty analyzes VPC Flow Logs, AWS CloudTrail event logs, and DNS logs, as well as other data sources, using threat intelligence feeds, machine learning, and anomaly detection to identify unexpected and potentially unauthorized activity. It is commonly used to detect things like unusual API calls, unauthorized deployments, and compromised instances.