Getting Started with Threat Detection on AWS: CloudTrail, GuardDuty, and Security Hub

Moving to the cloud doesn't remove the need for security monitoring. It changes where you look. On AWS, three services give you a strong foundation for detecting suspicious activity: **AWS CloudTrail**, **Amazon GuardDuty**, and **AWS Security Hub**.

## 1. CloudTrail: the record of what happened

CloudTrail records API activity in your account: who made a call, from which IP address, at what time, and whether it succeeded. Console logins, IAM changes, and S3 policy updates all show up here.

When an incident happens, CloudTrail answers the first question every investigator asks: *what actually happened?*

**Setup tips**
- Create a **multi-region trail** so no region becomes a blind spot.
- Deliver logs to a dedicated S3 bucket with **log file validation** enabled.
- Tightly restrict who can stop or delete the trail. Disabling logging is a common early move for attackers.

## 2. GuardDuty: managed threat detection

GuardDuty continuously analyzes CloudTrail events, VPC Flow Logs, and DNS logs, using threat intelligence and anomaly detection. There are no agents to install and no infrastructure to manage. You enable it, and findings appear with a severity rating.

Examples of what it can flag:
- API calls from unusual locations or anonymizing networks
- EC2 instances communicating with known malicious IP addresses
- Signs of compromised IAM credentials
- Suspicious access patterns on S3 data

## 3. Security Hub: one place to see everything

Security Hub aggregates findings from GuardDuty and other AWS security services into one view, and it also runs automated checks against security best practices, such as the AWS Foundational Security Best Practices standard. Instead of jumping between consoles, your team gets a single prioritized list.

## Putting it together

| Service | Role | Question it answers |
|---|---|---|
| CloudTrail | Activity logging | What happened? |
| GuardDuty | Threat detection | Is something suspicious going on? |
| Security Hub | Aggregation and posture checks | What should I fix first? |

## Investigating your first finding

1. Open the finding in GuardDuty and note the **severity, resource, and actor** (IP address or IAM identity).
2. Search CloudTrail for that identity or IP to build a timeline of its activity.
3. Check whether the activity is expected, such as a developer traveling or a known automation job.
4. If it's malicious, contain it: revoke the credentials, isolate the instance, and rotate secrets.
5. Document what you found and tune your alerts so the next response is faster.

## Common mistakes to avoid

- Enabling services in only one region
- Ignoring low-severity findings that, together, tell a story
- Collecting alerts without anyone assigned to review them
- Leaving long-lived access keys in use

## Conclusion

You don't need a large security team to get started. Turning on CloudTrail, GuardDuty, and Security Hub gives you logging, detection, and prioritization in one setup. From there, you can add automated responses with Amazon EventBridge and AWS Lambda, and build detections tailored to your environment.

*What's the first security finding you investigated on AWS? Share in the comments.*