Functionality

1. GuardDuty can continuously monitor any AWS account or workload for malicious activity and unauthorized behavior.
2. This is done from billions of events recorded via AWS CloudTrail, Amazon Virtual Private Cloud (VPC) Flow logs, and Domain Name System (DNS) logs.