skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-cloud-threats-with-guardduty

Deploy and operationalize Amazon GuardDuty for continuous threat detection across AWS accounts and workloads.

954|172|Updated Mar 13, 2026
Search Tags:#incident response#threat detection#cloud security#EventBridge#guardduty#runtime monitoring#AWS security
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill detecting-cloud-threats-with-guardduty
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-cloud-threats-with-guardduty
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/cloud-security/detecting-cloud-threats-with-guardduty
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-cloud-threats-with-guardduty

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security teams struggle to establish continuous threat detection across AWS accounts and often miss coverage gaps such as disabled protection plans, unmonitored regions, or missing runtime agents, leaving real attacks undetected.

Core Features & Use Cases

  • GuardDuty Deployment: Enable detectors, protection plans (S3, EKS, Runtime Monitoring, Malware Protection), and multi-account aggregation via delegated administrator.
  • Finding Analysis & Response: Interpret severity levels and attack sequence findings, then build automated containment workflows with EventBridge and Lambda.
  • Coverage Validation: Verify detectors in every region, confirm runtime agent health, and test the pipeline end-to-end with sample findings.
  • Use Case: When GuardDuty flags a CryptoCurrency:Runtime/BitcoinTool.B finding on an ECS task, follow the workflow to stop the task, quarantine the image, trace the deployment via CloudTrail, and revoke compromised credentials.

Quick Start

Ask the AI to enable GuardDuty with all protection plans across your AWS organization and set up an EventBridge rule that auto-isolates EC2 instances with high-severity findings.

Frequently Asked Questions about detecting-cloud-threats-with-guardduty

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enable Amazon GuardDuty across multiple AWS accounts?▼

Enable GuardDuty across multiple accounts by designating a delegated administrator account with enable-organization-admin-account, then use update-organization-configuration with auto-enable-organization-members set to ALL. This automatically enrolls every member account in your AWS Organization.

How to automate incident response for GuardDuty findings?▼

Automate GuardDuty incident response by creating an EventBridge rule matching findings with severity numeric >= 7, targeting a Lambda function. The Lambda can isolate compromised EC2 instances by replacing their security groups with an isolation group and tagging them for investigation.

Why is GuardDuty not detecting threats in some regions?▼

GuardDuty detectors are regional, so a detector in us-east-1 is blind to activity in other regions. Run list-detectors in every region and verify protection plans like S3 Protection and Runtime Monitoring are individually enabled via get-detector.

Does GuardDuty Runtime Monitoring work on all EC2 instances automatically?▼

Enabling EC2_AGENT_MANAGEMENT does not guarantee the agent runs on every instance. Check get-coverage-statistics or list-coverage for UNHEALTHY or missing hosts to confirm actual agent deployment across your fleet.

When should I not use GuardDuty for threat detection?▼

GuardDuty only covers AWS environments, so use Microsoft Defender for Azure or dedicated tools for GCP. It is also not suited for static code analysis or compliance posture monitoring, which are better handled by AWS Security Hub.

Related Skills

Explore More Software Engineering Skills→
YukiIto1999YukiIto1999

performing-cloud-log-forensics-with-athena

Query AWS CloudTrail, VPC Flow, S3, and ALB logs with Athena.

Community
Advanced
awsaws
2.5k

aws-security

Review AWS security service configurations and summarize findings using read-only CLI APIs.

Official
Advanced
jacketlong23jacketlong23

networkx

Create, analyze, and visualize complex networks and graphs in Python.

Community
Advanced
YukiIto1999YukiIto1999

securing-azure-with-microsoft-defender

Deploy Defender for Cloud across Azure, AWS, and GCP to establish security posture baselines.

Community
Advanced