A HARD LOOK AT GUARDDUTY SHORTCOMINGS

Summary from the TLDR InfoSec newsletter

This article evaluates Amazon GuardDuty's coverage, efficacy, and cost. Coverage was limited to core attacks on core services, with few finding types across a few services. Foundational features are worth enabling, but others can be costly. GuardDuty failed to detect many tested attacks and had a best-case latency of 5:08 for an S3 ransomware simulation.