Lion Cipher Lab

Set up AWS GuardDuty threat detection (your own free-tier account, sample findings)

• Cloud Security
• Beginner
• ~45 min
• Free · no account required

Why it matters

In the cloud, the danger is not only a bad setting sitting still -- it is malicious ACTIVITY happening right now: stolen credentials being used from a strange country, an instance quietly talking to a known-bad server, someone probing your account. You cannot watch for that by hand. Threat detection is the discipline of having a service watch the account's activity for you and raise an ALERT the moment something looks like an attack. On AWS the built-in answer is Amazon GuardDuty: you switch it on, and it continuously reads the account's own activity logs -- the record of every API call…

What you'll learn

• what cloud threat detection is: a service that watches your account's activity and raises an alert when something looks malicious
• what Amazon GuardDuty is and where its signal comes from -- the foundational data sources CloudTrail, VPC flow logs, and DNS query logs -- with no logging for you to set up
• enabling GuardDuty in your own free-tier account, one Region at a time, and understanding the 30-day free trial
• generating SAMPLE findings with GuardDuty's built-in button so you can learn the console safely, with no real attack and no risk
• reading a finding: the [SAMPLE] prefix, the finding type, the affected resource, and the full JSON detail
• what severity means -- GuardDuty's 1.0-10.0 scale split into Critical / High / Medium / Low -- and how it drives what you do first (triage)
• routing findings to a human: sending GuardDuty alerts to your email through EventBridge and SNS, the seed of a real detection-and-response pipeline
• closing the loop safely: archiving sample findings and suspending or disabling GuardDuty so no charges accrue, on an account you own

Steps in this lab

1. Read this first: your own account, sample findings only, turn it off when done
2. What threat detection is -- findings, severity, and where GuardDuty's signal comes from
3. Sign in to a free-tier AWS account (and secure the root login)
4. Understand the Region picker before you enable anything
5. Enable GuardDuty
6. Generate sample findings (safe, fake alerts to practice on)
7. Read one finding: type, affected resource, and the raw JSON
8. Triage by severity -- decide what to deal with first
9. Route a finding to a human: send alerts to your email
10. Clean up: archive samples, then suspend or disable GuardDuty
11. Why this loop makes you a cloud defender

Open the full interactive lab →