Overview

The AWS GuardDuty integration polls the GuardDuty Findings API to ingest:

• Suspicious EC2 activity (port scanning, crypto-mining, C2 communication)
• IAM credential abuse and unusual API patterns
• S3 data exfiltration and bucket access anomalies
• EKS audit findings and runtime malware detections

Prerequisites

• GuardDuty enabled in each AWS Region you want to monitor.
• The GuardDuty Detector ID for the target Region.
• IAM credentials with read access to GuardDuty.

Step 1: Enable GuardDuty and find the detector ID

1. Open the AWS Console → GuardDuty.
2. If GuardDuty is not yet enabled in this Region, click Get started → Enable GuardDuty.
3. In Settings → General, copy the Detector ID (looks like 12abc34d567e8f90gh1ijkl234mnop56).

Tip: For organization-wide collection, designate a delegated administrator account and use that account's detector ID.

Step 2: Create an IAM user for GuardDuty

1. Open IAM → Users → Create user, name it atatus-guardduty-reader.
2. Attach the AWS-managed policy AmazonGuardDutyReadOnlyAccess.
3. Open Security credentials → Create access key, choose Application running outside AWS, and copy the Access key ID and Secret access key.

Step 3: Connect AWS GuardDuty in Atatus

1. In Atatus, go to Security → Cloud SIEM → Integrations.
2. Locate the AWS GuardDuty card and click Connect.
3. Fill in the form:

1. Click Connect.

Verification

• The AWS GuardDuty card shows Configured.
• Findings appear in Security → Cloud SIEM → Audit Logs → Events with source aws_guardduty.