AWS GuardDuty Reviews

Name: AWS GuardDuty
Brand: Amazon Web Services (AWS)
Rating: 4.1 (22 reviews)

4.1 out of 5

22 reviews
91% willing to recommend

281 followers

What is AWS GuardDuty?

Amazon Guard Duty is a continuous cloud security monitoring service that consistently monitors and administers several data sources. These include AWS CloudTrail data events for EKS (Elastic Kubernetes Service) audit logs, VPC (Virtual Private Cloud) flow logs, DNS (Domain Name System) logs, S3 (Simple Cloud Storage), and AWS CloudTrail event logs.

Amazon GuardDuty intuitively uses threat intelligence data - such as lists of malicious domains and IP addresses - and ML (machine learning) to quickly discover suspicious and problematic activity in a user's AWS ecosystem. Activities may include concerns such as interactions with malicious IP addresses or domains, exposed credentials usage, or changes and/or escalation of privileges.

GuardDuty is able to easily determine problematic AWS EC2 (Elastic Compute Cloud) instances delivering malware or mining bitcoin. It is also able to trace AWS account access history for evidence of destabilization. such as suspicious API calls resulting in changing password policies to minimize password strength or anomalous infrastructure deployments in new or different never-used regions.

Get the AWS GuardDuty Buyer's Guide and find out what your peers are saying about AWS GuardDuty, Wiz, Microsoft Defender for Cloud and more!

AWS GuardDuty is the #5 ranked solution in Cloud Workload Protection Platforms. PeerSpot users give AWS GuardDuty an average rating of 8.2 out of 10. AWS GuardDuty is most commonly compared to Wiz: AWS GuardDuty vs Wiz. AWS GuardDuty is popular among the large enterprise segment, accounting for 66% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a financial services firm, accounting for 16% of all views.

Helped 838,533 peers since 2012

Featured reviews

Terence Dube

AWS Cloud Engineer at Standard Telephones and Cables

GuardDuty is limited to AWS environments. While incorporating Amazon Detective for detailed investigation can be useful, including more granular details in findings, such as specific user actions or historical comparisons, would be beneficial. Furthermore, managing global AWS environments requires setting up additional tools for viewing GuardDuty findings across multiple regions. A unified dashboard that aggregates findings across all regions without requiring manual aggregation could enhance convenience for users.

Read full review

Syeda Masarath Zaidi

DevOps Engineer at Cognizant

GuardDuty is extensive in terms of configuration and security compliance. It integrates with threat detection, offering end-to-end visibility. The best thing is that it notifies you immediately when something goes wrong, allowing quick response to threats. Our infrastructure is continuously monitored, safeguarding it against threats. Even internal threats are easy to identify. AWS monitors user behavior, which helps detect compromised credentials.

Read full review

Pratik-Savla

Security and Compliance Architect at a manufacturing company with 1,001-5,000 employees

Because it's a threat detection service, they need to keep up with the various threat factors because new threat factors and attack factors come up all the time. Sometimes they may detect a certain behavior. But if that behavior morphs into something else, GuardDuty may not pick up on that specifically if something new comes up which hasn't been found or uncovered before. If Amazon doesn't update the service to reflect that or address that or factor that in, it may not detect the threat. The end user then is obviously at the mercy of whatever it flags. GuardDuty must ensure they cover everything, including the latest threats.

Read full review

AWS GuardDuty mindshare

As of February 2025, the mindshare of AWS GuardDuty in the Cloud Workload Protection Platforms (CWPP) category stands at 9.2%, down from 9.8% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Cloud Workload Protection Platforms (CWPP)

PeerAnalyst reports

Type	Title	Date
Category	Cloud Workload Protection Platforms (CWPP)	Feb 20, 2025	Download
Product	Reviews, tips, and advice from real users	Feb 20, 2025	Download
Comparison	AWS GuardDuty vs Cortex Cloud by Palo Alto Networks	Feb 20, 2025	Download
Comparison	AWS GuardDuty vs Wiz	Feb 20, 2025	Download
Comparison	AWS GuardDuty vs Microsoft Defender for Cloud	Feb 20, 2025	Download

Title	Rating	Mindshare	Recommending
Wiz	4.5	17.4%	100%	20 interviews Add to research
Microsoft Defender for Cloud	4.0	13.0%	94%	74 interviews Add to research

Valuable Features

AWS GuardDuty offers valuable features such as centralized data collection, effective alert mechanisms, behavior analysis, and comprehensive threat detection. Users benefit from monitoring AWS accounts for malicious activity, leveraging logs like CloudTrail and VPC Flow Logs for security insights. It provides integrations, supports anomaly detection, uses machine learning for threat identification, protects S3 data events, and monitors EC2 instances. Its ease of use, cost-effectiveness, and continuous monitoring enhance AWS security.

"Overall, GuardDuty is a very easy-to-use tool, and I would recommend it even to those who are not tech-savvy."
"GuardDuty's comprehensive threat detection does not only monitor data - it also detects a wide range of security threats."
"GuardDuty is extensive in terms of configuration and security compliance."

Room for Improvement

AWS GuardDuty users suggest improvements such as a mobile version for remote access and better integration with other AWS services. More customer-focused features like automation, cost-efficiency, and enhanced threat intelligence are recommended. Users desire improved detection accuracy, insightful dashboards, and enhanced user interfaces. They also express a need for clearer cost projections and better technical support. Enhanced communication features, such as assigning findings to specific users, are also desired, along with better scalability for global environments.

"GuardDuty is limited to AWS environments."
"GuardDuty is limited to AWS environments."
"I would like to see more integration with other AWS provided services."

ROI

AWS GuardDuty offers a significant return on investment by providing threat detection and enhancing security posture. Its ability to detect threats early minimizes incidents and breaches, thus building customer trust and potentially attracting more business. Users express satisfaction with its performance in identifying and mitigating attacks. The improved response times due to quick notifications result in substantial time savings, showing its overall effectiveness in improving security and operational efficiency.

Pricing

AWS GuardDuty utilizes a pay-as-you-go pricing model, which many find competitively priced. Costs are generally based on data processed or events analyzed, starting around $1 per GB and decreasing with higher usage volumes. Licensing is integrated with AWS, and the service charges based on usage, allowing flexibility. While some view its pricing as high at larger scales, many smaller organizations find it manageable. Overall, its transparent, predictable model aligns with enterprise budgeting needs.

"The tool's licensing model is pay-as-you-go."
"80 percent of the customers are using AWS GuardDuty, and we recommend it due to its low cost, especially for small customers, ranging from five to ten dollars a month. In our policies, we enforce the usage of this service, making it a recommended practice for security."
"It can get very expensive. If you turn on every feature, it can turn into hundreds of thousands of dollars."

Popular Use Cases

Organizations primarily use AWS GuardDuty for threat detection, monitoring cloud environments, and identifying anomalies such as suspicious activities, unauthorized access, and potential attacks. It aids in compliance by collecting logs and analyzing data sources like CloudTrail logs and VPC Flow Logs. AWS GuardDuty helps secure various AWS services by detecting vulnerabilities and providing actionable insights categorized by severity. It supports security teams to prioritize responses and monitors assets and workloads for abnormal activities and security risks.

Service and Support

AWS GuardDuty customer service and support receive mixed responses. Many find the support team responsive with quick resolutions, leveraging chat, phone, and web support. While the 24/7 availability is appreciated, occasional delays in phone support assignment are noted. Users rarely escalate issues, and enterprise plan users benefit from quicker service. Documentation is praised for clarity. Experiences vary due to inconsistencies in representative helpfulness, suggesting room for improvement despite a strong effort from AWS.

Deployment

AWS GuardDuty is generally easy to set up, often requiring just a few clicks. The setup process is quick, typically completed in a few minutes through AWS Management Console. Complexity might arise during integration with other systems or infrastructure as code. However, for most architectures, the deployment is straightforward and does not require extensive resources or training. Users find the tool intuitive, and it adapts well to rapid updates and changes within AWS environments.

Scalability

AWS GuardDuty receives positive feedback for its scalability, accommodating growing environments and increasing data volumes. It supports dynamic scaling across multiple accounts and adapts well to network changes. Despite initial challenges, it effectively meets scaling needs and is rated highly by users. Organizations benefit from its ability to handle numerous users without significant issues, making it adaptable for large and small firms. Its managed service nature eliminates concerns about infrastructure management.

Stability

AWS GuardDuty is praised for high stability, consistently operating without outages or significant performance issues. Many organizations successfully implement it within production environments, using it alongside Cloud Trail and CloudWatch for enhanced observability. Rated between eight and ten out of ten for stability, users appreciate its reliability. Some mention performance degradation and false positives, but these do not affect usability significantly. GuardDuty's machine learning-backed capabilities and responsive analytics further enhance stability perceptions.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our AWS GuardDuty Buyer's Guide for additional reliable information.

Review data by company size

By reviewers

By visitors reading reviews

Top industries

By visitors reading reviews

Financial Services Firm

16%

Computer Software Company

15%

Manufacturing Company

Government

Healthcare Company

Retailer

Insurance Company

Comms Service Provider

Energy/Utilities Company

University

Educational Organization

Media Company

Non Profit

Transportation Company

Construction Company

Legal Firm

Real Estate/Law Firm

Outsourcing Company

Recreational Facilities/Services Company

Wholesaler/Distributor

Consumer Goods Company

Hospitality Company

Pharma/Biotech Company

Performing Arts

Logistics Company

Marketing Services Firm

Sports Company

Compare AWS GuardDuty with alternative products

Learn more about AWS GuardDuty

GuardDuty will continually alert users regarding their AWS environment status and will send the security discoveries to the GuardDuty dashboard or Amazon CloudWatch events for users to view.

Users can access GuardDuty via:

AWS SDKs: Amazon provides users with several software development kits (SDKs) that are made up of libraries and sample code of numerous popular programming languages and platforms, such as Android, iOS, Java, .Net, Python, and Ruby. The SDKs make it easier to develop programmatic access to GuardDuty.
GuardDuty HTTPS API: This allows users to issue HTTPS requests directly to the service.
GuardDuty Console: This is a browser-based intuitive dashboard interface where users can access and use GuardDuty.

Amazon Elastic Kubernetes Service (Amazon EKS)

Kubernetes protection is an optional add-on in Amazon GuardDuty. This tool is able to discover malicious behavior and possible destabilization of an organization's Kubernetes clusters inside of Amazon Elastic Kubernetes Service (Amazon EKS).

When Amazon EKS is activated, GuardDuty will actively use various data sources to discover potential risks against Kubernetes API. When Kubernetes protection is enabled, GuardDuty uses optional data sources to detect threats against Kubernetes API.

Kubernetes audit logs are a Kubernetes feature that captures historical API activity from applications, the control plane, users, and endpoints. GuardDuty collates these logs from Amazon EKS to create Kubernetes discoveries for the organization's Amazon EKS assets; there is no need to store or turn on the logs.

As long as Kubernetes protection remains activated, GuardDuty will continuously dissect Kubernetes data sources from the Amazon EKS clusters to ensure no suspicious or anomalous behavior is taking place.

Amazon Simple Cloud Storage (S3) Protection

Amazon S3 allows Amazon GuardDuty to actively audit object-level API processes to discover possible security threats to data inside an organization's S3 buckets. GuardDuty continually audits risk to the organization’s S3 assets by carefully dissecting AWS CloudTrail management events and AWS CloudTrail S3 data events. These tools are continually auditing various CloudTrail management events for potential suspicious activities that affect S3 buckets, such as PutBucketReplication, DeleteBucket, ListBucket, and data events for S3 object-level API processes, such as PutObject, GetObject, ListObject, and DeleteObject.

Reviews from Real Users

“The most valuable features are the single system for data collection and the alert mechanisms. Prior to using GuardDuty, we had multiple systems to collect data and put it in a centralized location so we could look into it. Now we don't need to do that anymore as GuardDuty does it for us.” - Arunkumar A., Information Security Manager at Tata Consultancy Services