So now let's learn about Amazon GuardDuty.
So Amazon GuardDuty is a service in AWS
that will perform intelligent threat discovery
in order to protect your AWS accounts.
So it's going to use machine learning algorithm
in the backend and do anomaly detection
and use third-party data to detect
if your account is under attack.
And it's just one click to enable
and you get a 30-days trial
and you don't need to install any kind of software,
it works in the backend as is.
So Amazon GuardDuty takes some input data
from several sources.
It takes data from your CloudTrail Events logs,
and it looks for unusual API calls
for unauthorized deployments, and so on.
So it can use, at the Management Events, for example,
these are the events that happen
when you create a VPC subnet, when you create a trail,
they're just API calls within your accounts.
And it also looks at CloudTrail S3 Data Events.
For example,
it looks at the events happening within your buckets.
So API calls such as get object, list objects,
delete object, and so on.
It looks at your VPC Flow Logs
to detect unusual internet traffic or unusual IP addresses,
your DNS Logs to look whether or not
you have compromised EC2 instances
that are going to send encoded data within DNS queries,
and finally your Kubernetes Audit Logs
to detect suspicious activities
and potential EKS cluster compromises.
So all these things are happening behind the scenes.
And then you're going to set up CloudWatch Event rules
to be modified in case of findings.
And in case you have findings,
well, you can set up a rule to target, for example,
a lambda function to do some action
or an SNS topic to send some emails.
Finally, and that's something that can come up in the exam,
GuardDuty can help you be protected
against CryptoCurrency attacks
because it has a dedicated finding for it.
So to summarize,
GuardDuty detects your VPC Flow logs,
your CloudTrail logs, your DNS logs,
as well as your EKS Audit logs.
They all go into GuardDuty
and then thanks to CloudWatch Event rules,
you're going to get lambda function
or SNS topics being notified, and you have the full picture.
All right, that's it for this lecture.
I hope you liked it,
and I will see you in the next lecture.