Amazon GuardDuty
What this tool proves, in the authored overlay. Every recipe below names Amazon GuardDuty; the controls are what their output is evidence for. The mapping is this project’s opinion (overlay v3.0.0) — the upstream FedRAMP rules name no vendor and no product.
Recipes calling Amazon GuardDuty (6)
- partialguardduty-suspicious-iam-activity-responsecontinuous
GuardDuty IAM/credential-abuse findings (detection) paired with CloudTrail records of the responsive action taken to disable or secure the affected privileged principal
- partialconfig-threat-monitoring-enabledcontinuous
AWS Config compliance results proving continuous security monitoring is switched on account-wide — GuardDuty threat detection enabled (optionally centralized to a delegated admin) and Security Hub aggregating control findings
- partialmalicious-code-protectionweekly
Whether malware scanning is switched on for compute and for the buckets that accept uploads, plus the scan-by-scan record of what was actually examined and what came back INFECTED
- partialguardduty-incident-after-actionquarterly
GuardDuty findings and Security Hub insight summaries that were reviewed, together with evidence that the findings fed into an after-action review cycle — AAR documents stored as versioned S3 objects with the incident IDs they reference
- partialsecurityhub-incident-review-proceduresmonthly
Security Hub finding workflow status plus GuardDuty detection coverage, showing incident response procedures are exercised: enabled insights, automated response actions routed through EventBridge, automated notifications, and Systems Manager Automation documents that encode response steps
- partialguardduty-pattern-review-past-incidentsquarterly
Recurring GuardDuty finding types and patterns queried across a multi-quarter window, plus Athena SQL over CloudTrail data, surfacing whether the same attack vectors repeat and whether the same misconfigurations are reintroduced after remediation
Controls it carries evidence for (17)
The reverse of the join above. A mark here is the control’s own grade across the whole corpus, not its grade from this tool alone — a control this tool partly proves may be fully proved with another.
Tool names are canonical, from data/overlays/aws-services.json and data/overlays/pipeline-tools.json. The two overlays that name services spelled five of them two ways; a page keyed on the raw string would have split those in half.