Threat Detection and Incident Response
Detection services and what they actually do
Amazon GuardDuty is a managed detector: it continuously analyzes VPC Flow Logs, CloudTrail management and S3 data events, Route 53 Resolver DNS query logs, and EKS audit logs, and optionally EBS volume scans, Lambda network activity, and RDS login activity. It emits typed findings such as UnauthorizedAccess:EC2/SSHBruteForce, retains them for 90 days, and takes no agents for the core detectors. It blocks nothing. Findings are published to EventBridge as GuardDuty Finding events, which is the hook for automated response.
Amazon Detective builds a behavior graph from those same sources so you can answer "what did this principal or IP touch, and when" during triage. Security Hub aggregates and normalizes findings into ASFF and scores them against standards such as FSBP and CIS; it is an aggregation and posture layer, not a detection engine.
Containment versus evidence
The exam loves the difference between containing an incident and destroying evidence. The standard containment step for a suspected compromised EC2 instance is to attach a restrictive security group with no inbound and no outbound rules (or egress only to a forensics VPC) and leave the instance running so memory and process state survive. Then snapshot EBS volumes for offline analysis. Terminating or rebooting the instance destroys volatile evidence.
Use a dedicated security/forensics account, break-glass credentials in Secrets Manager, and a log-archive bucket whose policy prevents even administrators from deleting CloudTrail and flow log data.
Rule of thumb
GuardDuty detects, Security Hub aggregates, Detective investigates, EventBridge responds, Config assesses. If a question asks for prevention, GuardDuty is never the answer.
Worked example: a High-severity UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration finding fires. Correct chain: an EventBridge rule matching the finding type invokes a Lambda that attaches a quarantine security group, tags the instance, and copies a snapshot to the forensics account; SNS pages on-call; then rotate the instance role credentials and review CloudTrail for API calls made with the stolen credentials.