GuardDuty and AWS Security Hub - Timing


Hi All,

Ive a quick question re: the timings of findings being generated and being accessible in AWS Security Hub via GuardDuty.

Without giving away the trade secrets, Im guessing there various step that take place from the point there is suspicious activity to it being available via the SecurityHub API.

Im guessing the steps would be:

  1. Suspicious activity on the account taking place
  2. GuardDuty observes and stores this finding
  3. GuardDuty then passes this to Security Hub or does Security Hub have the same access to the GuardDuty repository (therefore does it get I the same time as GuardDuty finds it?)
  4. Available to be pulled via the findings API

What are the timeframes of these steps?

Im trying to understand how quickly I can access the finding from the point the suspious activity happened.

Thanks all.

1 Answer

Guardduty is designed to analyze account and network activity in near real time and at scale. The findings are available for retrieval through Guardduty API.

When GuardDuty creates a new finding, it is usually sent to Security Hub within five minutes. More details about Guardduty and Security Hub integration can be found here.

answered 3 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions