AWS GuardDuty Findings

Ingest AWS GuardDuty threat findings into Bronto — compromised credentials, unusual API calls, malware, and suspicious network activity — via EventBridge.

AWS GuardDuty produces findings — threat-intelligence alerts covering compromised credentials, unusual API calls, reconnaissance activity, malware on EC2 and EKS workloads, and other security events.

​

Recommended method

EventBridge API Destinations — GuardDuty publishes findings as EventBridge events, so a rule with an API Destination delivers them to Bronto in real time over HTTPS.

New findings reach EventBridge within about five minutes. Updates to existing findings are published on the Frequency for updated findings setting in GuardDuty (every 15 minutes, 1 hour, or 6 hours by default), which applies to both EventBridge and S3 export. Archived and suppressed findings aren’t exported.

​

Alternatives

• S3 Log Forwarder — for environments that already export findings to an S3 bucket via the GuardDuty findings-export feature. GuardDuty writes findings as gzip-compressed JSON Lines (.jsonl.gz) encrypted with an AWS KMS key, so the forwarder’s Lambda role needs kms:Decrypt on that key.

See Ingesting AWS Data into Bronto for the full service-to-method mapping.

​

References

• AWS GuardDuty — exporting findings