GuardDuty

Amazon GuardDuty is a managed threat detection service that monitors for suspicious and malicious behaviors within AWS accounts and workloads. GuardDuty analyzes telemetry from sources such as AWS CloudTrail event logs, VPC flow logs, DNS logs, and other sources, and produces findings that represent potential security issues within the customer's AWS environment.