2.1.3. Metrics, Alerts, and Dashboards for Anomaly Detection

First Principle: Detection without alerting is just logging. The value of monitoring comes from surfacing anomalies to the right people (or automated systems) fast enough to act before damage escalates.

Amazon GuardDuty provides intelligent threat detection by continuously analyzing:

• CloudTrail management events — unusual API calls, unauthorized Region usage
• CloudTrail S3 data events — suspicious data access patterns
• VPC Flow Logs — communication with known malicious IPs, cryptocurrency mining
• DNS logs — domain generation algorithm (DGA) detection, C2 communication
• Runtime Monitoring (EKS, ECS including Fargate, and EC2) — a GuardDuty-managed security agent sees OS-level process, file and network events, such as a crypto-miner running inside a container. Distinct from EKS Audit Log Monitoring, which analyzes Kubernetes control-plane API audit logs, not activity inside containers
• Lambda Protection — monitors the network activity of Lambda invocations (for example, connections to a crypto-mining pool). Unusual API calls made with a function's role are caught by GuardDuty's CloudTrail analysis, like any other principal's
• Malware Protection for EC2 — when a finding suggests malware, GuardDuty snapshots the attached EBS volumes and scans replica volumes in a GuardDuty service account, so the running instance is never paused and needs no scanning agent

GuardDuty uses machine learning to establish behavioral baselines and generates findings with severity levels (Low, Medium, High, Critical).

Amazon Macie specifically detects sensitive data exposure:

• Scans S3 buckets for PII, PHI, financial data, credentials
• Alerts on buckets with public access containing sensitive data
• Integrates with Security Hub for centralized visibility
• Custom data identifiers — a regex (plus optional keywords and match distance) that you define for organization-specific formats the managed data identifiers don't recognize, then include in sensitive data discovery jobs

CloudWatch Alarms and Dashboards:

• Metric alarms: trigger on threshold breaches (CPU > 90%, error rate > 5%)
• Anomaly detection: ML-based bands that alert on statistical anomalies without hard-coded thresholds
• Composite alarms: combine multiple alarms to reduce false positives
• Dashboards: visual aggregation of metrics for real-time operational awareness

Alert Routing:

EventBridge is the routing engine that connects detection to response — matching finding patterns and dispatching to the appropriate handler.

For the human side, AWS User Notifications is the central place to configure and view notifications from AWS services across accounts and Regions (user-configured notifications are driven by EventBridge rules), delivered to the Console Notifications Center, email, the AWS Console Mobile App, or chat channels (Amazon Q Developer in chat applications, formerly AWS Chatbot) — instead of maintaining separate SNS topics in every account and Region.

⚠️ Exam Trap: GuardDuty generates findings but doesn't remediate. EventBridge + Lambda (or Step Functions) handle automated response. If a question asks about "automatically responding to a GuardDuty finding," the answer involves EventBridge, not GuardDuty alone.

Scenario: GuardDuty detects cryptocurrency mining on an EC2 instance (finding type: CryptoCurrency:EC2/BitcoinTool.B!DNS). An EventBridge rule matches this finding type and triggers a Lambda function that isolates the instance by applying a quarantine security group.

Reflection Question: Why does the exam emphasize EventBridge as the bridge between detection and response, rather than having security services trigger remediation directly?