Amazon GuardDuty is AWS's cloud security service that uses AI and machine learning to automatically monitor customer cloud environments for hacking attempts, credential theft, malware, and multi-step cyberattacks. It processes billions of signals at once and alerts security teams to critical threats without human review of every event.

GuardDuty Extended Threat Detection uses artificial intelligence and machine learning algorithms trained at AWS scale and automatically correlates security signals from across AWS services to detect critical threats, including attack sequences such as credential compromise followed by data exfiltration. This capability launched in general availability in December 2024 and is automatically enabled at no additional cost for all GuardDuty customers. GuardDuty is capable of analyzing tens of billions of events across multiple AWS data sources, including AWS CloudTrail logs, Amazon VPC Flow Logs, and DNS logs.