Threat Detection
The AWS detection services overlap enough to be confused with each other, but each answers a distinct question. Choosing between them is usually a matter of deciding which question is being asked.
| Service | Question it answers | Works on |
|---|---|---|
| Amazon GuardDuty | Is something malicious happening right now? | CloudTrail management events, VPC flow logs, Route 53 Resolver DNS query logs, plus optional protection plans |
| Amazon Inspector | Do the workloads carry known vulnerabilities? | EC2 instances, ECR container images, Lambda functions and layers |
| Amazon Macie | Is sensitive data sitting somewhere it should not be? | Amazon S3 general purpose buckets |
| Amazon Detective | What actually happened, and how far did it reach? | A behaviour graph built from CloudTrail, VPC flow logs and GuardDuty findings |
| AWS Security Hub CSPM | Where does the estate stand against a standard, and where are all the findings? | Findings from the services above, plus configuration checks driven by AWS Config |
GuardDuty is a continuous monitor: it watches log streams it consumes itself and raises a finding when behaviour matches a threat pattern or departs from the learned baseline. Inspector is a vulnerability scanner: it discovers eligible resources and rescans them whenever a package changes or a new CVE is published. Detective is an investigation tool reached after a finding exists — it reconstructs the sequence of events and the relationships between the resources involved. Security Hub CSPM is the aggregation layer: findings arrive in a single format (the AWS Security Finding Format) so that one console and one set of automation rules cover all of them.
The managed security services overview compares these alongside the network-protection services and describes how they are deployed across an organisation.
A note on naming: AWS renamed the posture-management service AWS Security Hub CSPM. The unqualified name AWS Security Hub now refers to a broader, tiered offering that correlates and enriches signals into prioritised risk analytics. When a document or console label says “Security Hub” without qualification, check which of the two it means.