GuardDuty Malware Protection for S3 service- scan duration

Hello.

As I answered in another question, EventBridge can notify you when a scan is completed.
The time is included in this event, so you can see information that can be used as an indicator rather than checking CloudWatch metrics.
https://docs.aws.amazon.com/guardduty/latest/ug/monitor-with-eventbridge-s3-malware-protection.html

I think it's also possible to check the timing when a tag was set with EventBridge.
For example, if you set up a rule like the one below, you'll be able to catch the event when a tag is set on an object in a bucket, and you'll also be able to check the time.

{
  "source": ["aws.s3"],
  "detail-type": ["Object Tags Added"],
  "detail": {
    "bucket": {
      "name": ["example-bucket-name"]
    }
  }
}