Detection
Detection is a layered capability: GuardDuty finds behaviour, Security Hub aggregates and scores posture, Inspector finds vulnerabilities, and Prowler independently assesses against benchmarks. No single source is sufficient.
The detection stack
| Service | What it detects | Scope |
|---|---|---|
| GuardDuty | Malicious behaviour — credential misuse, crypto-mining, C2 traffic, port scanning, anomalous API calls | Account-wide, continuous |
| Security Hub | Aggregated findings and compliance posture against enabled standards | Organisation-wide |
| Inspector | Vulnerabilities in EC2, container images and Lambda | Per resource, continuous |
| Macie | Sensitive data in S3 | Per bucket |
| Config | Configuration drift and rule violations | Organisation-wide |
| Prowler | Independent posture assessment against CIS, ISO, SOC 2 and others | On demand or scheduled |
| CloudTrail + metric filters | Specific API events that should never happen silently | Organisation-wide |
GuardDuty
Enablement
- Enabled in every account and every governed region.
- Delegated administrator in the security account; member accounts enrolled automatically by the organisation.
- All data sources on: CloudTrail management events, S3 data events, VPC Flow Logs, DNS logs, EKS audit logs, Lambda network activity, RDS login activity, EBS malware protection.
- S3 protection and malware scanning enabled where the workload stores uploads.
Finding routing
GuardDuty finding
→ EventBridge rule
├── severity ≥ 7 → SNS → security on-call (page)
├── severity 4–6 → ticket
└── severity < 4 → daily digest
Automated containment
| Finding | Automated response |
|---|---|
Credential misuse (UnauthorizedAccess:IAMUser) | Deactivate the access key or attach a deny-all policy to the role |
EC2 instance compromised (UnauthorizedAccess:EC2) | Replace security group with an isolation group; snapshot volumes |
Crypto-mining (CryptoCurrency:EC2) | Isolate the instance; open an incident |
| S3 anomalous access | Block public access on the bucket; alert |
| EKS anomalous behaviour | Cordon the node; preserve logs |
Automation contains. A human decides whether to terminate, restore or investigate further.
Security Hub
Standards
| Standard | Use |
|---|---|
| AWS Foundational Security Best Practices | Default baseline |
| CIS AWS Foundations Benchmark | Customers with a CIS obligation |
| PCI DSS | Payment workloads |
| NIST 800-53 | Public sector and regulated customers |
Aggregation
- Delegated administrator in the security account.
- Findings from all member accounts and regions aggregated.
- Cross-region aggregation to a single home region.
Workflow
Findings move through NEW → NOTIFIED → RESOLVED or SUPPRESSED. A finding
suppressed without a recorded justification is a finding ignored.
| Severity | Response target |
|---|---|
| Critical | Same day |
| High | Within 3 days |
| Medium | Within 30 days |
| Low | Next maintenance cycle |
Inspector
| Asset | Enabled | Scan |
|---|---|---|
| EC2 | Yes | Continuous, on launch |
| ECR images | Yes | On push and continuous rescan |
| Lambda | Yes | On deploy and continuous |
Findings are prioritised by network reachability and exploitability, so a vulnerability on an internet-facing instance outranks the same CVE on an isolated one.
Prowler
Prowler provides an independent assessment — a second opinion that does not depend on the same configuration that the posture is being measured against.
# Organisation-wide assessment, CIS 1.5, all regions
prowler aws \
--profile security-audit \
--compliance cis_1.5_aws \
--output-directory ./reports \
--output-formats json-ocsf,html,csv
Cadence
| Assessment | Frequency | Consumer |
|---|---|---|
| CIS benchmark | Monthly | Security team |
| Well-Architected security pillar | Quarterly | Delivery lead and customer |
| Custom control set | On change | Platform team |
Results are compared against the previous run. A regression is more informative than a score.
CloudTrail-derived alarms
Independent of the managed services, a small set of API events is alarmed directly because it should never happen quietly:
| Event | Reason |
|---|---|
| Root login | Root should not be used |
StopLogging / DeleteTrail | Covering tracks |
AuthorizeSecurityGroupIngress to 0.0.0.0/0 | Exposure |
PutBucketPolicy making a bucket public | Data exposure |
ScheduleKeyDeletion | Irreversible data loss |
CreateAccessKey on a user | Long-lived credential |
ConsoleLogin without MFA | Credential compromise |
LeaveOrganization | Guardrail escape |
Triage
A finding is not an incident until it is triaged. The triage questions:
- Is it real? Check the resource, the principal and the timing against CloudTrail.
- Is it exposed? Public-facing, or isolated?
- What is the blast radius? Which data, which accounts, which customers?
- Is it contained? If not, contain first and investigate second.
- What is the root cause? A misconfiguration, a credential, a vulnerable dependency, or an insider?
The outcome is recorded against the finding so the next occurrence benefits.
Evidence
- GuardDuty configuration and member account list.
- Security Hub standards enabled and current score.
- Inspector coverage and open findings.
- Prowler report with the comparison to the previous period.
- Finding triage records with resolution.
- Automated response configuration.