detecting-cloud-threats-with-guardduty

name	detecting-cloud-threats-with-guardduty
description	Use when this skill teaches security teams how to deploy and operationalize Amazon GuardDuty for continuous threat detection across AWS accounts and workloads. It covers enabling protection plans for S3, EKS, EC2 runtime monitoring, and Lambda, interpreting finding severity levels, and building automated response workflows using EventBridge and Lambda.
domain	cybersecurity
tags	["amazon-guardduty","threat-detection","aws-security","runtime-monitoring","cloud-soc"]
subdomain	cloud-security
version	1.0.0
author	oyi77
license	Apache-2.0
nist_csf	["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"]

Detecting Cloud Threats With Guardduty

Overview

Cybersecurity skill for detecting cloud threats with guardduty. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "detecting cloud threats with guardduty"

• "Use when working with detecting cloud threats with guardduty"

• When establishing continuous threat detection for new or existing AWS accounts

• When investigating GuardDuty findings related to compromised instances, credential abuse, or data exfiltration

• When building automated incident response playbooks triggered by GuardDuty findings

• When extending threat coverage to container workloads running on EKS, ECS, or Fargate

• When enabling malware scanning for EBS volumes attached to suspicious EC2 instances

Do not use for Azure or GCP threat detection (see securing-azure-with-microsoft-defender or auditing-gcp-security-posture), for static code analysis, or for compliance posture monitoring (see implementing-aws-security-hub).

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• AWS account with GuardDuty administrative permissions (guardduty:*)
• AWS CloudTrail, VPC Flow Logs, and DNS query logs enabled (GuardDuty consumes these automatically)
• AWS Organizations configured if deploying GuardDuty across a multi-account estate
• EventBridge and Lambda configured for automated response workflows

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}