AWS GuardDuty findings

aws guardduty list-findings --detector-id <id>

List GuardDuty findings of the detector with the CLI, reviewing threat detections of the AWS account.

Run it when you need GuardDuty findings: list-findings returns the finding IDs of the detector (with get-findings for detail) — the account detections: unusual API activity, compromised credentials, crypto-mining, scanned ports, anomalous IAM behaviors. It's the review of GuardDuty alerts from the CLI: the SOC queries new findings, their severity, and the detail (account, resource, IP). In AWS IR, GuardDuty is the managed detection layer: high-severity findings (an instance mining, a key used from a rare IP) are the starting point of the incident.

Don't use it as complete detection: GuardDuty covers known patterns of the account (API, network, crypto) — environment-specific behavior (a custom app, a business pattern) requires your own rules (CloudWatch, Athena). Coverage depends on configuration (active detector, regions, plan) and on finding latency (GuardDuty latency can be hours). And watch out for noise: low-severity findings (scans, normal CI/CD behavior) require triage — severity and context decide. Finding management (archiving false positives, integration with Security Hub) is part of the flow; the CLI lists, analysis correlates.