1 Answer
- Newest
- Most votes
- Most comments
2
Yes, GuardDuty will analyze the VPC flow logs as they are generated. When you enable GuardDuty, it immediately starts analyzing your VPC flow logs from Amazon EC2 instances within your account. It consumes VPC flow log events directly from the VPC Flow Logs feature through an independent and duplicative stream of flow logs. This process does not affect any of your existing flow logs configuration.
The VPC flow logs you have delivered to your buckets are derived from the same internal data source as GuardDuty uses to analyse flow logs. So GuardDuty not need access to the S3 bucket that is used for storing VPC flow logs as it will not access the logs from there.
answered 2 years ago
Relevant content
- asked 2 years ago
- asked 6 months ago
- AWS OFFICIALUpdated 6 months ago
- AWS OFFICIALUpdated 2 years ago
- AWS OFFICIALUpdated 2 years ago
- AWS OFFICIALUpdated a year ago
Awesome, thank you!