​
Overview

The AWS GuardDuty integration polls the GuardDuty Findings API to ingest:
  • Suspicious EC2 activity (port scanning, crypto-mining, C2 communication)
  • IAM credential abuse and unusual API patterns
  • S3 data exfiltration and bucket access anomalies
  • EKS audit findings and runtime malware detections

​
Prerequisites

  • GuardDuty enabled in each AWS Region you want to monitor.
  • The GuardDuty Detector ID for the target Region.
  • IAM credentials with read access to GuardDuty.

​
Step 1: Enable GuardDuty and find the detector ID

  1. Open the AWS Console → GuardDuty.
  2. If GuardDuty is not yet enabled in this Region, click Get started → Enable GuardDuty.
  3. In Settings → General, copy the Detector ID (looks like 12abc34d567e8f90gh1ijkl234mnop56).
For organization-wide collection, designate a delegated administrator account and use that account’s detector ID.

​
Step 2: Create an IAM user for GuardDuty

  1. Open IAM → Users → Create user, name it atatus-guardduty-reader.
  2. Attach the AWS-managed policy AmazonGuardDutyReadOnlyAccess.
  3. Open Security credentials → Create access key, choose Application running outside AWS, and copy the Access key ID and Secret access key.

​
Step 3: Connect AWS GuardDuty in Atatus

  1. In Atatus, go to Security → Cloud SIEM → Integrations.
  2. Locate the AWS GuardDuty card and click Connect.
  3. Fill in the form:
  1. Click Connect.

​
Verification

  • The AWS GuardDuty card shows Configured.
  • Findings appear in Security → Cloud SIEM → Audit Logs → Events with source aws_guardduty.