Key Takeaway
- AWS GuardDuty continuously monitors AWS accounts and workloads for suspicious activity, with no additional infrastructure to set up.
- It analyses data from multiple sources within your AWS environment: account activity, network traffic, and DNS queries, to detect threats including compromised credentials, unusual access patterns, and malware.
- Extended Threat Detection, added in December 2024, identifies multi-stage attacks that unfold across different services and time periods.
- With 2,366 cybersecurity incidents recorded in Malaysia in the first half of 2025, and the Cyber Security Act 2024 now in effect, cloud security monitoring is a practical requirement for businesses in regulated sectors.
- VSTECS KU, as Malaysia’s first authorised AWS distributor, supports GuardDuty deployments for businesses managing AWS security across single and multi-account environments.
Introduction
AWS GuardDuty is the automated monitoring layer for AWS environments. Its relevance to cybersecurity in Malaysia is directly tied to what is happening in the local threat landscape.
Malaysia’s Cyber Security Act 2024 (Act 854) came into full effect in August 2024, placing mandatory obligations on organisations across 11 critical sectors including banking, energy, transport, and government. These obligations include annual risk assessments, incident reporting to the National Cyber Security Agency (NACSA), and biennial security audits.
On the ground, NACSA recorded 2,366 cybersecurity incidents in the first half of 2025. Attacks targeting healthcare, manufacturing, and logistics providers have grown in frequency and complexity, with credential theft, ransomware, and AI-assisted phishing all featuring heavily.
A cloud environment running on AWS generates a constant stream of security-relevant activity: API calls, storage access, network connections, authentication events. At any meaningful scale, tracking all of this manually is not practical. GuardDuty analyses it automatically, surfacing threats that need attention rather than flooding teams with raw log data.
What Is AWS GuardDuty and What Does It Monitor?
AWS GuardDuty is a fully managed cloud security service. It analyses activity across an AWS environment and raises alerts when it detects behaviour that looks suspicious or potentially malicious. There is no agent to install and no separate logging infrastructure to set up. It works by processing log data that AWS already produces from its own services.
The main data sources GuardDuty monitors:
| Data Source | What It Covers |
| CloudTrail events (AWS’s account activity log) | Who did what, when, and from where (every API call made in the account) |
| VPC Flow Logs (Virtual Private Cloud network logs) | Network traffic flowing in and out of cloud resources |
| DNS query logs | Domain name requests, which can reveal malware activity or data being sent out |
| Kubernetes audit logs | Activity inside containerised applications, if this option is enabled |
| S3 data access logs | Unusual access to cloud storage buckets, if this option is enabled |
| RDS login activity | Brute-force attempts and suspicious logins to cloud databases, if enabled |
When GuardDuty identifies a potential threat, it creates a finding: a structured report that includes the severity level, the specific resource affected, and a description of what triggered it.
What Threats Does GuardDuty Detect?
Compromised Credentials
When AWS access keys or user login credentials are stolen or leaked, attackers use them to access resources, run up compute costs, or extract data. GuardDuty identifies usage that looks out of character for an account: logins from unusual locations, access at unusual times, or actions that do not match the account’s normal behaviour.
Reconnaissance and Enumeration
Before launching an attack, intruders probe an environment to understand its layout: what resources exist, what permissions apply, and where data sits. GuardDuty recognises API call sequences that follow known reconnaissance patterns and raises them as findings.
Unusual Network Activity
Traffic to known malicious IP addresses, unusually large volumes of outbound data, or DNS requests to domains linked to malware activity all generate findings. Network-level monitoring in a cloud environment requires analysing logs at a scale that is difficult to do manually. GuardDuty handles this continuously in the background.
Malware in Servers and Containers
When GuardDuty detects suspicious behaviour on a virtual server (an EC2 instance, which is AWS’s standard compute unit), it can scan the attached storage for malware. This covers situations where malware enters through a compromised application or workload.
Threats Targeting AI Services
GuardDuty also monitors activity on Amazon Bedrock and SageMaker environments. It detects anomalous usage of AI models, cost harvesting attacks where someone uses your AI services without your authorisation, and prompt injection attempts targeting AI agents.
What Is GuardDuty Extended Threat Detection?
Most security tools flag individual suspicious events. Extended Threat Detection (ETD), introduced in December 2024 and expanded to virtual servers and containers in December 2025, does something different: it correlates signals from multiple sources over time to reconstruct the full sequence of an attack.
A real attack rarely happens in a single step. An attacker might steal a set of credentials today, wait three days, then use them to quietly copy files from cloud storage before escalating privileges further. Each step might look minor in isolation. Seen together, they form a clear pattern.
ETD presents these sequences as a single, critical-severity finding that includes:
- A summary of the full attack chain
- A timeline showing each event and when it occurred
- Mapping to MITRE ATT&CK (a widely used framework that categorises attacker tactics and techniques)
- Specific steps for remediation
ETD activates automatically for all GuardDuty accounts with no extra cost. Enabling additional protection options for cloud storage, databases, Kubernetes workloads, and runtime monitoring widens the pool of signals GuardDuty can draw from, which improves its ability to spot complex patterns.
A finding that shows a credential was used from an unusual location is information. A finding that links that same credential to data leaving a storage bucket three days later is something a security team can act on. That is what Extended Threat Detection adds.
How GuardDuty Connects to Your Response Workflow
GuardDuty generates findings. What happens next depends on the workflow built around them.
AWS Security Hub pulls findings from GuardDuty (and other AWS security tools) into a single dashboard. Rather than checking multiple consoles, security teams get one view across the entire account or across multiple accounts. For organisations managing cloud security in Malaysia under the Cyber Security Act, this consolidated view also supports audit documentation and NACSA incident reporting requirements.
Amazon EventBridge enables automated responses to findings. When GuardDuty detects a server connecting to a known malicious address, an EventBridge rule can automatically isolate that server, notify the security team, or kick off a response process, all before anyone has had to manually read the alert.
For businesses running multiple AWS accounts (separate accounts for development, staging, and production are common), GuardDuty can be centrally managed through a single administrator account. All findings across accounts and regions flow into one place.
Detection without a response process is just a stream of alerts. Connecting GuardDuty to Security Hub and EventBridge is what turns that stream into an active cloud security posture.
What to Know Before Turning GuardDuty On
| Area | What to Know |
| Setup | No agent installation needed. GuardDuty activates through the AWS console in minutes and builds its own activity baseline automatically. |
| Cost | Usage-based pricing, charged on data volume processed. The core service covers account activity, network, and DNS logs. Storage, database, Kubernetes, and malware scanning options are priced separately. A 30-day free trial is available. |
| Finding management | GuardDuty raises findings but does not respond to them on its own. Decide in advance: who reviews findings, which severity levels require immediate action, and which responses should be automated. |
| Multi-account setup | If your organisation uses separate AWS accounts, a delegated administrator account (a central AWS account given oversight permissions) can manage GuardDuty findings across all of them from one place. |
How VSTECS KU Supports GuardDuty Deployments
As Malaysia’s first authorised AWS distributor, VSTECS KU gives businesses local access to the full AWS services catalogue including GuardDuty, with support from a team in Malaysia rather than through international channels.
VSTECS KU’s professional services team can assess your current security posture on AWS, scope a GuardDuty deployment across single or multiple accounts, and configure the integrations that turn threat alerts into actionable workflows. AWS GuardDuty sits within a broader AWS cloud solutions security approach that covers identity, network controls, and data protection alongside continuous threat monitoring.
Frequently Asked Questions
1. What does AWS GuardDuty detect?
GuardDuty detects compromised credentials being misused, unusual network activity, reconnaissance behaviour, malware on virtual servers and containers, and threats to AI services. Extended Threat Detection links these signals over time to surface complete attack sequences rather than isolated events.
2. Does GuardDuty require agent installation or extra infrastructure?
No. It analyses log data that AWS already generates from its own services. There is no software to install on servers or separate infrastructure to manage. Enabling it takes a few clicks in the AWS console.
3. How does GuardDuty support Malaysia’s Cyber Security Act 2024 compliance?
The Act requires organisations in critical sectors to maintain active security monitoring, conduct annual risk assessments, and report incidents to NACSA. GuardDuty provides the continuous monitoring layer and structured findings that support those requirements. Connecting it to Security Hub creates a centralised view that also serves as an audit trail for cybersecurity in Malaysia regulatory reporting.
4. What is the difference between GuardDuty and a firewall?
A firewall decides which traffic can enter or leave based on defined rules. It works at the boundary of the network. GuardDuty works inside the environment, analysing behaviour after traffic has already passed through, detecting threats that are already active rather than blocking entry. The two address different problems: a firewall prevents unwanted traffic from entering; GuardDuty detects threats already inside the environment.
5. How is GuardDuty priced?
It uses usage-based pricing based on the volume of data processed. The core service covers account activity logs, network logs, and DNS logs. Separate add-on plans exist for cloud storage, databases, containers, and malware scanning, each charged by data volume. A 30-day free trial applies to new activations in any AWS account.
For Malaysian businesses building or reviewing their cloud security posture on AWS, VSTECS KU’s professional services team can scope a GuardDuty deployment that fits your environment and aligns with cybersecurity in Malaysia compliance requirements. Contact the team through the professional services page.