Amazon GuardDuty

1. Concepts and key terms

   Detectors, findings, severity levels and protection plans.

2. Foundational data sources

   CloudTrail events, VPC flow logs and DNS logs analyzed by GuardDuty.

3. Protection plans

   S3, EKS, RDS, Lambda and malware protection features.

4. S3 Protection

   Monitoring S3 data events for suspicious access.

5. EKS Protection

   Audit log monitoring for Kubernetes clusters.

6. Runtime Monitoring

   Agent-based detection on EC2, ECS and EKS workloads.

7. Malware Protection for EC2

   Scanning EBS volumes for malware.

8. Finding types

   Catalog of finding types by resource and threat category.

9. Managing findings

   Suppression rules, filters and exporting findings.

10. Remediating findings

    Responding to compromised instances, credentials and buckets.

11. Multiple accounts

    Delegated administrator and member accounts through Organizations.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.