Why didn't GuardDuty generate any finding types after I activated GuardDuty in my environment?

Resolution

Check GuardDuty status

Make sure that you activated GuardDuty. If you suspended or turned off GuardDuty, then GuardDuty doesn't generate any finding types. It's a best practice to activate GuardDuty in all supported AWS Regions. This allows GuardDuty to generate finding types for unauthorized or unusual activity even in Regions that you aren't actively using.

Note: If GuardDuty doesn't detect security threats, then it doesn't generate a finding type.

Activate data sources

GuardDuty uses data sources to detect unauthorized and unexpected activity with resource types for some AWS services. Confirm that you activated all data sources.

It's a best practice to activate the following protections:

• Amazon Elastic Kubernetes Service (Amazon EKS) Protection
• Amazon Simple Storage Service (Amazon) S3 Protection
• Malware Protection for Amazon Elastic Compute Cloud (Amazon EC2)

If GuardDuty doesn't detect a malicious file as malware, then check that you turned on the necessary protections. Confirm the malware status of the files.

Note: GuardDuty only processes DNS logs when you use the default virtual private cloud (VPC) DNS resolver. Other types of DNS resolvers won't generate DNS based findings.

Review suppressed findings from trusted IP address lists

If you set up trusted IP address lists, then they can prevent the generation of finding types for events that occur from trusted IP addresses.

It's a best practice to use a suppression rule instead of a trusted IP address list for awareness of detected issues in your environment. You can review suppressed findings from the GuardDuty console by changing the Findings view menu from Current to Archived.

Test sample findings

To create sample GuardDuty findings to test, take one of the following actions:

• Create sample findings from the GuardDuty console or API.
• Run tester scripts to generate findings.

Related information

Getting started with GuardDuty

Why did GuardDuty send me alert findings for a trusted IP list address?