Amazon Detective vs GuardDuty for Security Teams: Introduction
Security teams handle multiple AWS security services and need to understand their functions and how to orchestrate them. They also have to handle overlapping alerts from different services referring to the same incident. Hence, security teams, when considering Amazon Detective vs GuardDuty they must realize one detects incidents and the other investigates them.
Whenever security teams utilize both these systems that must first realize that GuardDuty focuses on the detection of security events. In contrast, Amazon Detective focuses on investigating detected security events to uncover their root causes and enable remediation. Correspondingly, the contrast between Amazon Detective and GuardDuty maps to the contrast between alerts versus contextual analysis for security teams. Another contrast that maps to this is between findings and behavioral insights.
Once security teams understand the differences between Amazon Detective and GuardDuty, they can discern when to use each service. Another insight for security teams is that these services complement each other, enabling them to effectively architect security workflows. However, it is important to address common security team misconceptions around these services and apply a real-world investigation context.
Amazon Detective vs GuardDuty: What GuardDuty Does for Security Teams
GuardDuty’s Role in AWS Security
GuardDuty is a managed threat detection service that continuously analyzes telemetry to identify threats and reports them downstream. It provides continuous monitoring across AWS accounts and regions, centrally managed either by a delegated administrator account or by AWS Organizations. Its telemetry is typically other AWS-native security services that monitor activity within AWS. These include CloudTrail, VPC Flow Logs, and Route 53 Resolver DNS query logs. For a deeper look at how these telemetry sources are collected, centralized, and governed, see our AWS Logging and Monitoring Guide. GuardDuty’s architecture allows it to perform near-real-time signal generation of threats uncovered from analyzing AWS activity telemetry. These near-real-time signals become actionable security findings that downstream services can use to form an effective response. It also ensures early incident awareness for security teams, which differentiates GuardDuty vs Security Hub.
How GuardDuty Detects Security Events
GuardDuty continuously analyzes AWS activity from raw data it consumes from AWS-native security telemetry services. This raw data includes API invocations reported by CloudTrail. It also includes network-level traffic metadata reported by VPC Flow Logs, and DNS activity reported by Route 53 Resolver DNS query logs. It searches this data for known threat patterns and analyzes it to identify behavioral anomalies indicative of threats.
GuardDuty utilizes a set of analysis algorithms and ML inference engines to perform near-real-time threat detection. Additionally, it evaluates each threat’s severity score to enable security teams and automated response systems to prioritize and triage threats. To support timely threat response, it performs continuous threat detection and evaluation. Therefore, it provides a continuous stream of findings in real time for early response visibility.
What GuardDuty Does Not Do
For GuardDuty vs Amazon Detective, it is important to establish boundaries for security teams to build loosely coupled security pipelines. Because it performs detection of threats, it does not perform any aggregation of threats or alerts. In the same way, it does not perform correlation of signals from different services but only evaluates data for threats. The other main point is that GuardDuty does not perform investigation workflows, as it focuses on detection rather than investigation. It follows that it does not reconstruct incident timelines, an investigation activity. Another investigative activity it does not perform is root-cause determination, which involves discovering the source of threats.
Amazon Detective vs GuardDuty: What Amazon Detective Does For Security Teams
Amazon Detective’s Role in AWS Security
To better understand Amazon Detective vs GuardDuty, it is important to understand what Amazon Detective does for security teams. We move from detection to investigation, where it is a security investigation service that focuses on post-detection analysis. To analyze security event findings, it reconstructs the incident context of these findings from detection sources. It performs several analyses to identify the causes of these security events, including historical behavior analysis by analyzing past activity patterns over time. It also combines data from multiple sources and performs cross-service activity correlation to identify the root cause. This makes it a significant tool for supporting root cause investigation.
How Amazon Detective Builds Investigation Context
Amazon Detective consumes AWS security telemetry from a variety of services to build context around security events. It performs several activities to achieve, including historical activity data analysis that distinguishes normal behavior from suspicious activity. Alongside this, it performs behavioral baselining over time, where it establishes normal activity patterns over time to identify deviations. It also performs the crucial task of cross-service activity correlation so that it considers all evidence like a real-life detective.
Amazon Detective provides several tools and views to aid analysts in exploring, correlating, and understanding an incident. The entity-centric investigation views are used to reveal relationships and activity patterns around key entities. These are complemented by relationship and activity timelines that allow analysts to track interactions and identify cause-and-effect relationships. Another complementary view is cross-resource interaction mappings that allow analysts to track how activity moves across resources. Finally, the hypothesis-driven incident analysis tool allows analysts to construct “what-if” scenarios to gain further insight into malicious activities.
What Amazon Detective Does Not Do
To better scope Amazon Detective vs GuardDuty, we should consider what it does not do for security teams. Unlike GuardDuty, it does not generate threats from telemetry data; it investigates them. It also does not provide real-time alerting. Furthermore, it never creates any security findings that GuardDuty creates from analyzing telemetry data. Because it does not perform these activities, it is not a replacement for GuardDuty, which is a mistake many teams make. It is also differentiated from Security Hub in that it does not aggregate or prioritize alerts. Instead, it uses them to determine the root cause. Unlike GuardDuty or Security Hub, it does not initiate automated remediation actions.
Detection vs Investigation for Security Teams: Amazon Detective and GuardDuty
Defining detection vs investigation helps crystallize how security teams use Amazon Detective and GuardDuty. GuardDuty is summarized as identifying suspicious activity by pattern analysis of AWS telemetry events. Conversely, Amazon Detective’s core function is to explain these security events by analyzing contextual data over time and other data sources. Accordingly, GuardDuty performs detection by informing that “something happened”. In contrast, Amazon Detective investigates the “something happened” to answer the “what and why”. Another contrast between the two is alerts versus contextual understanding. This is further understood by framing this as signals versus incident narratives.
It is also critical to understand why there is this distinction between the services and their role and functions. Amazon Detective, adding context to GuardDuty alerts, reduces the workload of operators trying to understand alert cause, thereby reducing alert fatigue. This also helps to address slow incident response by significantly reducing the time operators spend determining alert context. Additionally, automated context building helps reduce errors and misinterpretation of security signals. Utilizing Amazon Detective shifts the effort of security teams from chasing alerts to resolving incidents. This also translates into Amazon Detective’s sophisticated analysis algorithms and ML in addressing security teams’ poor root-cause understanding.
It is useful to consider how Amazon Detective and GuardDuty fit together to benefit security teams, from the perspective of detection vs. investigation. The key concept is that detection feeds investigation, so the two activities work together. Detection maps to GuardDuty, which generates security signals from telemetry signals. Correspondingly, the investigation maps to Amazon Detective, which provides context for GuardDuty’s security signals. This clearly illustrates how investigation follows detection. While the “vs” is used between the two, they are not adversarial but provide complementary service roles. This provides end-to-end incident understanding.
When Should Security Teams Use Amazon Detective vs GuardDuty?
Amazon Detective and GuardDuty are complementary for security teams, so it really is not a case of who vs who. It is selecting the right service for the right job; this is intent-driven service selection. Consequently, the security team should be asking questions around detection versus investigation when selecting a service. This translates to understanding context and not feature comparison, and how each service fits into the workflow.
GuardDuty’s place in the workflow is to detect suspicious activities based on telemetry data from other sources. It continuously receives and monitors this telemetry data, performing near-real-time analysis to identify suspicious events. Subsequently, it provides security teams with early incident awareness, allowing rapid response. Furthermore, it is able to uncover unknown or emerging threats before they materialize into full-blown security incidents. Additionally, it provides initial alerting and triage, taking the cognitive load off security teams.
Correspondingly, Amazon Detective’s place in the workflow is performing post-detection investigation. This is after GuardDuty has detected suspicious activity and raised an alert. For each incident, it determines and clarifies the scope of the incident. It also reconstructs the timeline for the incident, providing insight into how it unfolded. Subsequently, it applies both the scope and timeline to perform a root cause analysis. Hence, it identifies the responsible actors and how they triggered the incident. Therefore, it enables context-driven response decisions.
Detection and investigation are complementary, with detection feeding investigation, making GuardDuty’s outputs Amazon Detective’s inputs. In this context, GuardDuty is responsible for initiating awareness of unfolding security events within the workflow. Afterwards, Amazon Detective’s role in the workflow is to provide context to these security events reported by GuardDuty. This establishes an end-to-end security incident workflow that allows security teams and automated processes to perform informed responses.
Common Misconceptions
The first misconception that security teams have around Amazon Detective vs GuardDuty is that one service replaces the other. Closely associated with this is the idea that these tools overlap each other in functionality. These assumptions often arise when security teams ignore system intent and select one tool over another. The consequence of these assumptions and decisions is broken security workflows.
Another serious misconception is when security teams mistake alerts for answers and fail to include investigation as part of the security workflow. This results in investigation context missing from the overall security picture presented to operators. Subsequently, this results in an incomplete incident picture where operators need to fill in the gaps. Operators, therefore, must perform guesswork before responding to any security incident.
Equally serious is when security teams are dismissive of automated investigation and assume that investigation can only be done manually. Analysts believe that they must manually piece together related evidence to understand an incident. This springs from the fact that they are unaware of how much context the system can build for them. The implication is that analyst time is seriously misallocated from activities where human oversight is needed.
Mistaking alert volume for coverage is another misconception that security teams make when they decide not to use Amazon Detective. This results in saturating operators with alert signals that carry no context. Along with signal overload, analysts have to manually provide context that increases their fatigue. This, in turn, lowers their effectiveness in performing investigations and weakens the overall security posture for the AWS environment.
Conclusion
There is an important distinction for security teams around Amazon Detective vs GuardDuty within the security workflow. This is around their roles, with GuardDuty performing detection while Amazon Detective performs investigation. These security services have distinct non-overlapping purposes and occupy different stages within the security workflow.
Security teams should frame these two security services as having complementary roles, with detection feeding investigation. Accordingly, investigation augments detected events with context that enables security teams to reach better-informed decisions. This data flow integrates GuardDuty and Amazon Detective within the workflow. GuardDuty sends security events to Amazon Detective, which establishes an end-to-end security workflow.
The key takeaway for security teams is to use these services as intent-driven in setting up the security pipeline. They should also have clear role expectations between the services and their complementary stages within the security pipeline. Therefore, this will lead to a workflow-oriented security design.
Further Reading
Security Pillar – AWS Well-Architected Framework
AWS services for logging and monitoring
AWS Certified Security Study Guide: Specialty (SCS-C01) Exam by Marcello Zillo Neto
Practical Cloud Security: A Guide for Secure Design and Deployment, 2nd Edition by Chris Dotson
