Threat Detection
Monitoring & DetectionThreat Detection is the process of identifying potential security threats in real-time or near-real-time. In AWS, threat detection combines multiple data sources (API logs, network traffic, DNS queries) with machine learning and threat intelligence to surface malicious activity.
AWS Threat Detection Services
- GuardDuty: behavioral analysis and anomaly detection across accounts
- Inspector: vulnerability scanning for EC2, Lambda, ECR, plus code security (SAST, SCA, and IaC scanning) since 2025
- Macie: sensitive data discovery in S3
- Security Hub: aggregation and compliance checks
- CloudWatch Anomaly Detection: metric-based anomaly alerts
- EventBridge: real-time event routing for automated response
Related AWS Services
Related Terms
AWS managed threat detection service that continuously monitors your accounts for malicious activity using CloudTrail, VPC Flow Logs, and DNS logs.
AWS service that aggregates security findings from GuardDuty, Inspector, Macie, and third-party tools into a single dashboard with compliance scoring.
The structured process of detecting, containing, eradicating, and recovering from a security incident, following frameworks like NIST SP 800-61.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.