Making sense of Amazon GuardDuty alerts

This post explains how Amazon GuardDuty operates—ingesting CloudTrail, VPC flow logs, and DNS to produce EC2- and IAMUser-based findings—highlights limitations of vendor threat lists, and recommends enriching alerts with passive DNS, WHOIS, and OSINT for better decision support; it also walks through sample and real-world alerts (including an IAM compromise and suspicious Tor-based access) and provides four practical takeaways for reviewing GuardDuty alerts.