GuardDuty is not enabled

Severity: Medium
Service: GuardDuty
Check ID: GUARDDUTY_OFF

What this check finds

GuardDuty is an AWS threat detection service that detects compromised access keys, EC2 instances, and more. It should be enabled in all regions.

Passing looks like: GuardDuty enabled.

How to fix it

Enable GuardDuty in every active region.

AWS CLI

aws guardduty create-detector --enable --region REGION

Consider enabling via AWS Organizations to auto-enroll all accounts and regions.

Names in capitals are placeholders for your own resource. Review a command before you run it.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to GuardDuty is not enabled
Framework	Controls
PCI-DSS v4.0.1	5.2 Malicious software is prevented, or detected and addressed 10.7 Failures of critical security control systems are detected, reported, and responded to promptly
HIPAA Security Rule	164.308(a)(1) Security Management Process — Risk Analysis 164.308(a)(6) Security Incident Procedures
SOC 2 — Trust Services Criteria	CC4.1 Ongoing Monitoring of Controls CC7.1 Threat and Vulnerability Detection
NIST SP 800-53 Rev5 (Moderate)	CA-7 Continuous Monitoring SI-3 Malicious Code Protection SI-4 System Monitoring
NIST Cybersecurity Framework 2.0	DE.CM-01 Networks are monitored DE.CM-09 Computing resources are monitored
ISO/IEC 27001:2022 Annex A	A.5.7 Threat intelligence A.5.25 Assessment and decision on information security events A.5.36 Compliance with policies, rules and standards for information security A.8.7 Protection against malware A.8.16 Monitoring activities

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs