> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tensor9.com/llms.txt
> Use this file to discover all available pages before exploring further.

# GuardDuty

> GuardDuty APIs with Cloud Adapter.

This page describes how GuardDuty maps to services in the environment where the application runs, including backend choices, supported operations and service-specific behavior.

## Supported environments

* Azure
* Google Cloud
* OCI

Check the operation and capability tables for the behavior your application depends on. A supported environment does not imply that every operation of the origin service is available.

## How the backends compare

Each row compares a capability of GuardDuty with its adaptation on each backend.
A dash means this profile does not state the capability for that backend.

### Cloud Adapter

| Capability | GuardDuty | Azure | Google Cloud | OCI |
| - | - | - | - | - |
| Continuous managed detection | Yes | Yes - Microsoft-operated Defender plans | Yes - Google-operated Security Command Center detectors | Yes - Oracle-operated Cloud Guard detector recipes |
| Detection sources · telemetry analyzed | CloudTrail, VPC Flow Logs, DNS, EKS audit, S3 data events | Azure signals supported by the configured Defender plans | Supported Google Cloud logs and signals; required services and modules must be enabled | OCI activity, configuration and threat signals supported by the selected recipes |
| Finding types · portability | GuardDuty finding types | Defender alert types; different rules and categories | Security Command Center categories; different detector rules | Cloud Guard problem types and detector rules |
| Severity-scored findings | Yes | Yes | Yes | Yes |
| Filters, IP sets, threat-intel sets | Yes | Partial - Review and recreate supported backend-specific rules | Partial - Review and recreate supported mute rules and other backend-specific settings | Partial - Review and recreate supported detector-rule conditions and managed lists |
| SIEM integrations and response | Yes | Yes - Microsoft Sentinel integrations, analytics rules and playbooks | Yes - Pub/Sub exports and Google SecOps integrations | Yes - OCI Events and optional Cloud Guard responder recipes |
| Enablement · how protection is configured | Detector and feature settings | Resource-specific Defender plans and settings | Security Command Center service tier, detectors and log sources | Detector and responder recipes attached to a compartment target |
| API coverage | full | partial | partial | partial |

## On Azure

### Microsoft Defender for Cloud

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| Account activity threat detection (CloudTrail analysis) | Detection sources | Supported | Common | Azure activity detection uses Azure's activity and resource-management signals. The events and alert types differ from CloudTrail-based findings. |
| DNS threat detection (DNS query-log analysis) | Detection sources | Supported | Most usage | DNS-related threats are detected through the signals available to the configured Defender plans. Review coverage for the DNS threats your application needs. |
| Kubernetes audit-log threat detection (EKS) | Detection sources | Supported | Most usage | Defender for Containers analyzes AKS audit and runtime signals. Its detection rules differ from GuardDuty's EKS rules. |
| Malware Protection (EBS volume scan) | Detection sources | Partial | Full surface | Defender for Servers provides malware detection, including agentless scanning in Plan 2. Select the required plan and scanning settings; detection differs from GuardDuty's EBS scan. |
| Network threat detection (VPC Flow Log analysis) | Detection sources | Partial | Most usage | Network alerts depend on Defender's available telemetry and plan configuration; they do not reproduce GuardDuty's VPC Flow Log finding catalog. |
| Detector enablement (Defender for Cloud plans) | Detector | Supported | Common | Maps to Microsoft Defender for Cloud plans, including Servers and Storage. Protection is configured by resource type rather than through one GuardDuty detector. |
| GuardDuty finding-type catalog | Findings | Out of scope | Full surface | GuardDuty finding-type strings are AWS-specific. Update automations that match them to use the relevant Defender alert types. |
| Publishing destination (S3 finding export) | Findings | Out of scope | Full surface | GuardDuty's S3 finding-export configuration does not translate directly. Select an Azure export destination and configure the required integration. |
| SIEM / event fan-out | Findings | Supported | Common | Microsoft Sentinel receives Defender alerts through its integrations. Response rules need to use Defender alert types rather than AWS event names. |
| Severity-scored findings | Findings | Supported | Common | Defender produces severity-scored Azure security alerts. Alert types and scoring differ from GuardDuty's. |
| Finding filters (aws\_guardduty\_filter) | Suppression + lists | Out of scope | Full surface | GuardDuty suppression rules do not translate directly. Review and recreate required exclusions using Defender's supported configuration. |
| Threat-intel sets (aws\_guardduty\_threatintelset) | Suppression + lists | Out of scope | Full surface | Custom GuardDuty threat feeds require a backend-specific integration; enabling Defender does not copy them. |
| Trusted IP sets (aws\_guardduty\_ipset) | Suppression + lists | Out of scope | Full surface | GuardDuty trusted-IP lists do not translate directly. Review the exclusions supported by the relevant Azure detector. |

#### How it works

On Azure, GuardDuty maps to Microsoft Defender for Cloud. When Tensor9 builds the deployment, it turns on two Defender plans for the subscription, Servers and Storage, at the Standard tier. Microsoft runs detection over your Azure resources and raises security alerts with severity levels. This is a best-effort match: Defender uses different signals and rules from GuardDuty, so review each threat scenario you depend on.

You choose any further protection your workload needs, such as Containers and subscription activity, and connect alerts to Microsoft Sentinel or another supported tool for analysis and response. Plan, telemetry and alert names differ from GuardDuty's detector and finding types.

![On AWS, GuardDuty analyzes AWS telemetry and reports severity-scored findings. On Azure, Tensor9 turns on the Defender for Cloud Servers and Storage plans when it builds the deployment; Defender analyzes Azure telemetry and raises alerts. Tensor9 is not in the detection path.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjEwIiB2aWV3Qm94PSIwIDAgODM2IDIxMCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MsIEd1YXJkRHV0eSBhbmFseXplcyBBV1MgdGVsZW1ldHJ5IGFuZCByZXBvcnRzIHNldmVyaXR5LXNjb3JlZCBmaW5kaW5ncy4gT24gQXp1cmUsIFRlbnNvcjkgdHVybnMgb24gdGhlIERlZmVuZGVyIGZvciBDbG91ZCBTZXJ2ZXJzIGFuZCBTdG9yYWdlIHBsYW5zIHdoZW4gaXQgYnVpbGRzIHRoZSBkZXBsb3ltZW50OyBEZWZlbmRlciBhbmFseXplcyBBenVyZSB0ZWxlbWV0cnkgYW5kIHJhaXNlcyBhbGVydHMuIFRlbnNvcjkgaXMgbm90IGluIHRoZSBkZXRlY3Rpb24gcGF0aC4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0iZ2RkYzEiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6Izk0YTNiOCIvPjwvbWFya2VyPjxtYXJrZXIgaWQ9ImdkZGMxYiIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojNGY0NmU1Ii8+PC9tYXJrZXI+PC9kZWZzPgo8cmVjdCB4PSIxNiIgeT0iNDAiIHdpZHRoPSIzODQiIGhlaWdodD0iMTUyIiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMzAiIHk9IjYwIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojNjQ3NDhiIj5PTiBBV1MgVE9EQVk8L3RleHQ+CjxyZWN0IHg9IjI4IiB5PSI3NiIgd2lkdGg9IjEyMCIgaGVpZ2h0PSI5NiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI4OCIgeT0iMTEyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjExcHgiPkFXUyB0ZWxlbWV0cnk8L3RleHQ+Cjx0ZXh0IHg9Ijg4IiB5PSIxMzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OXB4Ij5DbG91ZFRyYWlsIMK3IFZQQyBGbG93PC90ZXh0Pgo8dGV4dCB4PSI4OCIgeT0iMTQ0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweCI+RE5TIMK3IEVLUyDCtyBTMzwvdGV4dD4KPGxpbmUgeDE9IjE0OCIgeTE9IjEyNCIgeDI9IjE3MCIgeTI9IjEyNCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2dkZGMxKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+CjxyZWN0IHg9IjE3MiIgeT0iOTQiIHdpZHRoPSIxMTIiIGhlaWdodD0iNjAiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMjI4IiB5PSIxMjAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTEuNXB4Ij5HdWFyZER1dHk8L3RleHQ+Cjx0ZXh0IHg9IjIyOCIgeT0iMTM2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjkuNXB4Ij5vbmUgZGV0ZWN0b3I8L3RleHQ+CjxsaW5lIHgxPSIyODQiIHkxPSIxMjQiIHgyPSIzMDYiIHkyPSIxMjQiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNnZGRjMSkiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSIzMDgiIHk9Ijk0IiB3aWR0aD0iODQiIGhlaWdodD0iNjAiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMzUwIiB5PSIxMjAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTAuNXB4Ij5GaW5kaW5nczwvdGV4dD4KPHRleHQgeD0iMzUwIiB5PSIxMzYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OXB4Ij5zZXZlcml0eS1zY29yZWQ8L3RleHQ+CjxsaW5lIHgxPSI0MTgiIHkxPSI0NiIgeDI9IjQxOCIgeTI9IjE4NiIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJzdHJva2U6I2NiZDVlMSIvPgo8cmVjdCB4PSI0MzYiIHk9IjQwIiB3aWR0aD0iMzg0IiBoZWlnaHQ9IjE1MiIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjQ1MCIgeT0iNjAiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiMwNDc4NTciPk9OIEFaVVJFPC90ZXh0Pgo8cmVjdCB4PSI0NDgiIHk9Ijc2IiB3aWR0aD0iMTE2IiBoZWlnaHQ9Ijk2IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjUwNiIgeT0iMTEyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjEwLjVweCI+QXp1cmUgdGVsZW1ldHJ5PC90ZXh0Pgo8dGV4dCB4PSI1MDYiIHk9IjEzMCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5cHgiPlNlcnZlcnMgcGxhbjwvdGV4dD4KPHRleHQgeD0iNTA2IiB5PSIxNDQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OXB4Ij5TdG9yYWdlIHBsYW48L3RleHQ+CjxsaW5lIHgxPSI1NjQiIHkxPSIxMjQiIHgyPSI1ODYiIHkyPSIxMjQiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNnZGRjMWIpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHJlY3QgeD0iNTg4IiB5PSI5MCIgd2lkdGg9IjE0MCIgaGVpZ2h0PSI2OCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNiIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6IzRmNDZlNSIvPgo8dGV4dCB4PSI2NTgiIHk9IjExNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMC41cHg7ZmlsbDojNGY0NmU1Ij5EZWZlbmRlciBmb3IgQ2xvdWQ8L3RleHQ+Cjx0ZXh0IHg9IjY1OCIgeT0iMTMwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweCI+U2VydmVycyDCtyBTdG9yYWdlPC90ZXh0Pgo8dGV4dCB4PSI2NTgiIHk9IjE0NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDYwMCAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3Ij5wbGFucyBlbmFibGVkPC90ZXh0Pgo8bGluZSB4MT0iNzI4IiB5MT0iMTI0IiB4Mj0iNzQ4IiB5Mj0iMTI0IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZ2RkYzFiKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+CjxyZWN0IHg9Ijc1MCIgeT0iOTQiIHdpZHRoPSI2NiIgaGVpZ2h0PSI2MCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI3ODMiIHk9IjExOCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZTo5LjVweCI+QWxlcnRzPC90ZXh0Pgo8dGV4dCB4PSI3ODMiIHk9IjEzNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo4LjVweCI+ZXhwb3J0IHNlcGFyYXRlPC90ZXh0Pgo8dGV4dCB4PSI2MjgiIHk9IjE4MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojMDQ3ODU3Ij5UZW5zb3I5IHR1cm5zIHRoZSBwbGFucyBvbiBhdCBkZXBsb3ltZW50OyBpdCBpcyBub3QgaW4gdGhlIGRldGVjdGlvbiBwYXRoPC90ZXh0Pgo8L3N2Zz4=)

![On AWS, GuardDuty analyzes AWS telemetry and reports severity-scored findings. On Azure, Tensor9 turns on the Defender for Cloud Servers and Storage plans when it builds the deployment; Defender analyzes Azure telemetry and raises alerts. Tensor9 is not in the detection path.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjEwIiB2aWV3Qm94PSIwIDAgODM2IDIxMCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MsIEd1YXJkRHV0eSBhbmFseXplcyBBV1MgdGVsZW1ldHJ5IGFuZCByZXBvcnRzIHNldmVyaXR5LXNjb3JlZCBmaW5kaW5ncy4gT24gQXp1cmUsIFRlbnNvcjkgdHVybnMgb24gdGhlIERlZmVuZGVyIGZvciBDbG91ZCBTZXJ2ZXJzIGFuZCBTdG9yYWdlIHBsYW5zIHdoZW4gaXQgYnVpbGRzIHRoZSBkZXBsb3ltZW50OyBEZWZlbmRlciBhbmFseXplcyBBenVyZSB0ZWxlbWV0cnkgYW5kIHJhaXNlcyBhbGVydHMuIFRlbnNvcjkgaXMgbm90IGluIHRoZSBkZXRlY3Rpb24gcGF0aC4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0iZ2RkYzEiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzY0NzQ4YiIvPjwvbWFya2VyPjxtYXJrZXIgaWQ9ImdkZGMxYiIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojYTViNGZjIi8+PC9tYXJrZXI+PC9kZWZzPgo8cmVjdCB4PSIxNiIgeT0iNDAiIHdpZHRoPSIzODQiIGhlaWdodD0iMTUyIiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMzAiIHk9IjYwIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojOTRhM2I4Ij5PTiBBV1MgVE9EQVk8L3RleHQ+CjxyZWN0IHg9IjI4IiB5PSI3NiIgd2lkdGg9IjEyMCIgaGVpZ2h0PSI5NiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI4OCIgeT0iMTEyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjExcHgiPkFXUyB0ZWxlbWV0cnk8L3RleHQ+Cjx0ZXh0IHg9Ijg4IiB5PSIxMzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OXB4Ij5DbG91ZFRyYWlsIMK3IFZQQyBGbG93PC90ZXh0Pgo8dGV4dCB4PSI4OCIgeT0iMTQ0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweCI+RE5TIMK3IEVLUyDCtyBTMzwvdGV4dD4KPGxpbmUgeDE9IjE0OCIgeTE9IjEyNCIgeDI9IjE3MCIgeTI9IjEyNCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2dkZGMxKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+CjxyZWN0IHg9IjE3MiIgeT0iOTQiIHdpZHRoPSIxMTIiIGhlaWdodD0iNjAiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMjI4IiB5PSIxMjAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTEuNXB4Ij5HdWFyZER1dHk8L3RleHQ+Cjx0ZXh0IHg9IjIyOCIgeT0iMTM2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjkuNXB4Ij5vbmUgZGV0ZWN0b3I8L3RleHQ+CjxsaW5lIHgxPSIyODQiIHkxPSIxMjQiIHgyPSIzMDYiIHkyPSIxMjQiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNnZGRjMSkiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSIzMDgiIHk9Ijk0IiB3aWR0aD0iODQiIGhlaWdodD0iNjAiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMzUwIiB5PSIxMjAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTAuNXB4Ij5GaW5kaW5nczwvdGV4dD4KPHRleHQgeD0iMzUwIiB5PSIxMzYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OXB4Ij5zZXZlcml0eS1zY29yZWQ8L3RleHQ+CjxsaW5lIHgxPSI0MTgiIHkxPSI0NiIgeDI9IjQxOCIgeTI9IjE4NiIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJzdHJva2U6IzQ3NTU2OSIvPgo8cmVjdCB4PSI0MzYiIHk9IjQwIiB3aWR0aD0iMzg0IiBoZWlnaHQ9IjE1MiIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjQ1MCIgeT0iNjAiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiM2ZWU3YjciPk9OIEFaVVJFPC90ZXh0Pgo8cmVjdCB4PSI0NDgiIHk9Ijc2IiB3aWR0aD0iMTE2IiBoZWlnaHQ9Ijk2IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjUwNiIgeT0iMTEyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjEwLjVweCI+QXp1cmUgdGVsZW1ldHJ5PC90ZXh0Pgo8dGV4dCB4PSI1MDYiIHk9IjEzMCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5cHgiPlNlcnZlcnMgcGxhbjwvdGV4dD4KPHRleHQgeD0iNTA2IiB5PSIxNDQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OXB4Ij5TdG9yYWdlIHBsYW48L3RleHQ+CjxsaW5lIHgxPSI1NjQiIHkxPSIxMjQiIHgyPSI1ODYiIHkyPSIxMjQiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNnZGRjMWIpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHJlY3QgeD0iNTg4IiB5PSI5MCIgd2lkdGg9IjE0MCIgaGVpZ2h0PSI2OCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNiIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6I2E1YjRmYyIvPgo8dGV4dCB4PSI2NTgiIHk9IjExNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMC41cHg7ZmlsbDojYTViNGZjIj5EZWZlbmRlciBmb3IgQ2xvdWQ8L3RleHQ+Cjx0ZXh0IHg9IjY1OCIgeT0iMTMwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweCI+U2VydmVycyDCtyBTdG9yYWdlPC90ZXh0Pgo8dGV4dCB4PSI2NTgiIHk9IjE0NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDYwMCAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3Ij5wbGFucyBlbmFibGVkPC90ZXh0Pgo8bGluZSB4MT0iNzI4IiB5MT0iMTI0IiB4Mj0iNzQ4IiB5Mj0iMTI0IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZ2RkYzFiKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+CjxyZWN0IHg9Ijc1MCIgeT0iOTQiIHdpZHRoPSI2NiIgaGVpZ2h0PSI2MCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI3ODMiIHk9IjExOCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZTo5LjVweCI+QWxlcnRzPC90ZXh0Pgo8dGV4dCB4PSI3ODMiIHk9IjEzNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo4LjVweCI+ZXhwb3J0IHNlcGFyYXRlPC90ZXh0Pgo8dGV4dCB4PSI2MjgiIHk9IjE4MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojNmVlN2I3Ij5UZW5zb3I5IHR1cm5zIHRoZSBwbGFucyBvbiBhdCBkZXBsb3ltZW50OyBpdCBpcyBub3QgaW4gdGhlIGRldGVjdGlvbiBwYXRoPC90ZXh0Pgo8L3N2Zz4=)

Tensor9 turns on Defender for Servers and Defender for Storage; you choose other protection and connect Sentinel.

#### What Tensor9 turns on

Tensor9 creates two `azurerm_security_center_subscription_pricing` resources at the Standard tier: `VirtualMachines` (Defender for Servers) and `StorageAccounts` (Defender for Storage). It creates them once per stack, however many detectors you declare, and none if the detector is disabled. Containers and subscription-activity protection need their own settings, which you configure.

Check the effective plan, subplan and extensions for your resources: a subscription-level plan does not mean every workload or scanning feature is protected. Choose telemetry collection and the Sentinel connection alongside the plans.

![Your GuardDuty detector becomes two Defender for Cloud plans at the Standard tier, Servers and Storage, turned on for the whole subscription. Containers and other protection are selected separately.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjMyIiB2aWV3Qm94PSIwIDAgODM2IDIzMiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJZb3VyIEd1YXJkRHV0eSBkZXRlY3RvciBiZWNvbWVzIHR3byBEZWZlbmRlciBmb3IgQ2xvdWQgcGxhbnMgYXQgdGhlIFN0YW5kYXJkIHRpZXIsIFNlcnZlcnMgYW5kIFN0b3JhZ2UsIHR1cm5lZCBvbiBmb3IgdGhlIHdob2xlIHN1YnNjcmlwdGlvbi4gQ29udGFpbmVycyBhbmQgb3RoZXIgcHJvdGVjdGlvbiBhcmUgc2VsZWN0ZWQgc2VwYXJhdGVseS4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0iZ2RkYzIiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6Izk0YTNiOCIvPjwvbWFya2VyPjwvZGVmcz4KPHRleHQgeD0iMjQiIHk9IjI2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojNjQ3NDhiIj5ZT1VSIEdVQVJERFVUWSBERVRFQ1RPUjwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjQwIiB3aWR0aD0iMTg4IiBoZWlnaHQ9IjcyIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjExOCIgeT0iNzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmb250LXNpemU6MTBweDtmaWxsOiMzMzQxNTUiPmF3c19ndWFyZGR1dHlfZGV0ZWN0b3I8L3RleHQ+Cjx0ZXh0IHg9IjExOCIgeT0iOTAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OS41cHgiPm9uZSBkZXRlY3RvciwgZmVhdHVyZSB0b2dnbGVzPC90ZXh0Pgo8bGluZSB4MT0iMjEyIiB5MT0iNzYiIHgyPSIyNTYiIHkyPSI3NiIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2dkZGMyKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+Cjx0ZXh0IHg9IjIzNCIgeT0iNjgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OHB4Ij5iZWNvbWVzPC90ZXh0Pgo8cmVjdCB4PSIyNjQiIHk9IjI0IiB3aWR0aD0iNTQ4IiBoZWlnaHQ9IjE4OCIgcng9IjEzIiBzdHJva2Utd2lkdGg9IjEuNiIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6IzRmNDZlNSIvPgo8dGV4dCB4PSIyODQiIHk9IjQ2IiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjExLjVweDtmaWxsOiM0ZjQ2ZTUiPk1pY3Jvc29mdCBEZWZlbmRlciBmb3IgQ2xvdWQgwrcgc3Vic2NyaXB0aW9uIHBsYW5zPC90ZXh0Pgo8cmVjdCB4PSIyODAiIHk9IjU4IiB3aWR0aD0iNTE2IiBoZWlnaHQ9IjQyIiByeD0iOCIgc3Ryb2tlLXdpZHRoPSIxLjIiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNlZWYyZmYiLz4KPHRleHQgeD0iMjk0IiB5PSI3NiIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo4LjVweDtmaWxsOiM0ZjQ2ZTUiPmF6dXJlcm1fc2VjdXJpdHlfY2VudGVyX3N1YnNjcmlwdGlvbl9wcmljaW5nPC90ZXh0Pgo8dGV4dCB4PSIyOTQiIHk9IjkyIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZm9udC1zaXplOjEwcHg7ZmlsbDojMzM0MTU1Ij50aWVyID0gIlN0YW5kYXJkIiAgIHJlc291cmNlX3R5cGUgPSAiVmlydHVhbE1hY2hpbmVzIjwvdGV4dD4KPHRleHQgeD0iNzgyIiB5PSI4NCIgdGV4dC1hbmNob3I9ImVuZCIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo4LjVweCI+RGVmZW5kZXIgZm9yIFNlcnZlcnM8L3RleHQ+CjxyZWN0IHg9IjI4MCIgeT0iMTA2IiB3aWR0aD0iNTE2IiBoZWlnaHQ9IjQyIiByeD0iOCIgc3Ryb2tlLXdpZHRoPSIxLjIiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNlZWYyZmYiLz4KPHRleHQgeD0iMjk0IiB5PSIxMjQiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OC41cHg7ZmlsbDojNGY0NmU1Ij5henVyZXJtX3NlY3VyaXR5X2NlbnRlcl9zdWJzY3JpcHRpb25fcHJpY2luZzwvdGV4dD4KPHRleHQgeD0iMjk0IiB5PSIxNDAiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmb250LXNpemU6MTBweDtmaWxsOiMzMzQxNTUiPnRpZXIgPSAiU3RhbmRhcmQiICAgcmVzb3VyY2VfdHlwZSA9ICJTdG9yYWdlQWNjb3VudHMiPC90ZXh0Pgo8dGV4dCB4PSI3ODIiIHk9IjEzMiIgdGV4dC1hbmNob3I9ImVuZCIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo4LjVweCI+RGVmZW5kZXIgZm9yIFN0b3JhZ2U8L3RleHQ+CjxyZWN0IHg9IjI4MCIgeT0iMTU0IiB3aWR0aD0iNTE2IiBoZWlnaHQ9IjQ0IiByeD0iOCIgc3Ryb2tlLXdpZHRoPSIxIiBzdHlsZT0iZmlsbDojZWVmMmZmO3N0cm9rZTojZWVmMmZmIi8+Cjx0ZXh0IHg9IjI5NCIgeT0iMTc0IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjkuNXB4O2ZpbGw6IzMzNDE1NSI+ZW5hYmxlZCBhdCB0aGUgc3Vic2NyaXB0aW9uIGxldmVsIMK3IE1pY3Jvc29mdCBvcGVyYXRlcyB0aGUgZGV0ZWN0aW9uIGVuZ2luZTwvdGV4dD4KPHRleHQgeD0iMjk0IiB5PSIxOTAiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OXB4O2ZpbGw6IzY0NzQ4YiI+U2VsZWN0IENvbnRhaW5lcnMgYW5kIG90aGVyIHJlcXVpcmVkIHByb3RlY3Rpb247IEROUyBwcm90ZWN0aW9uIHVzZXMgU2VydmVyczwvdGV4dD4KPC9zdmc+)

![Your GuardDuty detector becomes two Defender for Cloud plans at the Standard tier, Servers and Storage, turned on for the whole subscription. Containers and other protection are selected separately.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjMyIiB2aWV3Qm94PSIwIDAgODM2IDIzMiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJZb3VyIEd1YXJkRHV0eSBkZXRlY3RvciBiZWNvbWVzIHR3byBEZWZlbmRlciBmb3IgQ2xvdWQgcGxhbnMgYXQgdGhlIFN0YW5kYXJkIHRpZXIsIFNlcnZlcnMgYW5kIFN0b3JhZ2UsIHR1cm5lZCBvbiBmb3IgdGhlIHdob2xlIHN1YnNjcmlwdGlvbi4gQ29udGFpbmVycyBhbmQgb3RoZXIgcHJvdGVjdGlvbiBhcmUgc2VsZWN0ZWQgc2VwYXJhdGVseS4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0iZ2RkYzIiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzY0NzQ4YiIvPjwvbWFya2VyPjwvZGVmcz4KPHRleHQgeD0iMjQiIHk9IjI2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojOTRhM2I4Ij5ZT1VSIEdVQVJERFVUWSBERVRFQ1RPUjwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjQwIiB3aWR0aD0iMTg4IiBoZWlnaHQ9IjcyIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjExOCIgeT0iNzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmb250LXNpemU6MTBweDtmaWxsOiNjYmQ1ZTEiPmF3c19ndWFyZGR1dHlfZGV0ZWN0b3I8L3RleHQ+Cjx0ZXh0IHg9IjExOCIgeT0iOTAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OS41cHgiPm9uZSBkZXRlY3RvciwgZmVhdHVyZSB0b2dnbGVzPC90ZXh0Pgo8bGluZSB4MT0iMjEyIiB5MT0iNzYiIHgyPSIyNTYiIHkyPSI3NiIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2dkZGMyKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+Cjx0ZXh0IHg9IjIzNCIgeT0iNjgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OHB4Ij5iZWNvbWVzPC90ZXh0Pgo8cmVjdCB4PSIyNjQiIHk9IjI0IiB3aWR0aD0iNTQ4IiBoZWlnaHQ9IjE4OCIgcng9IjEzIiBzdHJva2Utd2lkdGg9IjEuNiIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6I2E1YjRmYyIvPgo8dGV4dCB4PSIyODQiIHk9IjQ2IiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjExLjVweDtmaWxsOiNhNWI0ZmMiPk1pY3Jvc29mdCBEZWZlbmRlciBmb3IgQ2xvdWQgwrcgc3Vic2NyaXB0aW9uIHBsYW5zPC90ZXh0Pgo8cmVjdCB4PSIyODAiIHk9IjU4IiB3aWR0aD0iNTE2IiBoZWlnaHQ9IjQyIiByeD0iOCIgc3Ryb2tlLXdpZHRoPSIxLjIiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiMxZTFiNGIiLz4KPHRleHQgeD0iMjk0IiB5PSI3NiIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo4LjVweDtmaWxsOiNhNWI0ZmMiPmF6dXJlcm1fc2VjdXJpdHlfY2VudGVyX3N1YnNjcmlwdGlvbl9wcmljaW5nPC90ZXh0Pgo8dGV4dCB4PSIyOTQiIHk9IjkyIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZm9udC1zaXplOjEwcHg7ZmlsbDojY2JkNWUxIj50aWVyID0gIlN0YW5kYXJkIiAgIHJlc291cmNlX3R5cGUgPSAiVmlydHVhbE1hY2hpbmVzIjwvdGV4dD4KPHRleHQgeD0iNzgyIiB5PSI4NCIgdGV4dC1hbmNob3I9ImVuZCIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo4LjVweCI+RGVmZW5kZXIgZm9yIFNlcnZlcnM8L3RleHQ+CjxyZWN0IHg9IjI4MCIgeT0iMTA2IiB3aWR0aD0iNTE2IiBoZWlnaHQ9IjQyIiByeD0iOCIgc3Ryb2tlLXdpZHRoPSIxLjIiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiMxZTFiNGIiLz4KPHRleHQgeD0iMjk0IiB5PSIxMjQiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OC41cHg7ZmlsbDojYTViNGZjIj5henVyZXJtX3NlY3VyaXR5X2NlbnRlcl9zdWJzY3JpcHRpb25fcHJpY2luZzwvdGV4dD4KPHRleHQgeD0iMjk0IiB5PSIxNDAiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmb250LXNpemU6MTBweDtmaWxsOiNjYmQ1ZTEiPnRpZXIgPSAiU3RhbmRhcmQiICAgcmVzb3VyY2VfdHlwZSA9ICJTdG9yYWdlQWNjb3VudHMiPC90ZXh0Pgo8dGV4dCB4PSI3ODIiIHk9IjEzMiIgdGV4dC1hbmNob3I9ImVuZCIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo4LjVweCI+RGVmZW5kZXIgZm9yIFN0b3JhZ2U8L3RleHQ+CjxyZWN0IHg9IjI4MCIgeT0iMTU0IiB3aWR0aD0iNTE2IiBoZWlnaHQ9IjQ0IiByeD0iOCIgc3Ryb2tlLXdpZHRoPSIxIiBzdHlsZT0iZmlsbDojMWUxYjRiO3N0cm9rZTojMWUxYjRiIi8+Cjx0ZXh0IHg9IjI5NCIgeT0iMTc0IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjkuNXB4O2ZpbGw6I2NiZDVlMSI+ZW5hYmxlZCBhdCB0aGUgc3Vic2NyaXB0aW9uIGxldmVsIMK3IE1pY3Jvc29mdCBvcGVyYXRlcyB0aGUgZGV0ZWN0aW9uIGVuZ2luZTwvdGV4dD4KPHRleHQgeD0iMjk0IiB5PSIxOTAiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OXB4O2ZpbGw6Izk0YTNiOCI+U2VsZWN0IENvbnRhaW5lcnMgYW5kIG90aGVyIHJlcXVpcmVkIHByb3RlY3Rpb247IEROUyBwcm90ZWN0aW9uIHVzZXMgU2VydmVyczwvdGV4dD4KPC9zdmc+)

The detector becomes one azurerm\_security\_center\_subscription\_pricing per plan, at the Standard tier, for the whole subscription.

#### Finding names and rules

GuardDuty finding identifiers such as `UnauthorizedAccess:EC2/SSHBruteForce`, `CryptoCurrency:EC2/BitcoinTool.B` and `Recon:EC2/Portscan` are AWS-specific. Defender uses its own alert names and severity assignments for threats such as brute-force attempts, cryptomining and port scans.

Review EventBridge filters, suppression rules and downstream parsers that use GuardDuty names, including patterns such as `CryptoCurrency:*`. Rewrite them for Defender's alerts and the signals each enabled plan analyzes. Turning on the plans does not translate those rules, and Defender does not detect exactly the same set of threats.

![GuardDuty finding types such as UnauthorizedAccess:EC2/SSHBruteForce become Defender alerts with their own names and severities, such as a brute-force attempt on a VM. Rules that match GuardDuty names must be rewritten.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjUwIiB2aWV3Qm94PSIwIDAgODM2IDI1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJHdWFyZER1dHkgZmluZGluZyB0eXBlcyBzdWNoIGFzIFVuYXV0aG9yaXplZEFjY2VzczpFQzIvU1NIQnJ1dGVGb3JjZSBiZWNvbWUgRGVmZW5kZXIgYWxlcnRzIHdpdGggdGhlaXIgb3duIG5hbWVzIGFuZCBzZXZlcml0aWVzLCBzdWNoIGFzIGEgYnJ1dGUtZm9yY2UgYXR0ZW1wdCBvbiBhIFZNLiBSdWxlcyB0aGF0IG1hdGNoIEd1YXJkRHV0eSBuYW1lcyBtdXN0IGJlIHJld3JpdHRlbi4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0iZ2RkYzMiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzRmNDZlNSIvPjwvbWFya2VyPjwvZGVmcz4KPHRleHQgeD0iMjQiIHk9IjI2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojNjQ3NDhiIj5HVUFSRERVVFkgRklORElORyBUWVBFUyDCtyBBIEZJWEVEIENBVEFMT0c8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSIzNiIgd2lkdGg9IjMzMCIgaGVpZ2h0PSIzMCIgcng9IjciIHN0cm9rZS13aWR0aD0iMS4yIiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjM4IiB5PSI1NiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6IzMzNDE1NSI+VW5hdXRob3JpemVkQWNjZXNzOkVDMi9TU0hCcnV0ZUZvcmNlPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iNzIiIHdpZHRoPSIzMzAiIGhlaWdodD0iMzAiIHJ4PSI3IiBzdHJva2Utd2lkdGg9IjEuMiIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIzOCIgeT0iOTIiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmb250LXNpemU6MTBweDtmaWxsOiMzMzQxNTUiPkNyeXB0b0N1cnJlbmN5OkVDMi9CaXRjb2luVG9vbC5CPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMTA4IiB3aWR0aD0iMzMwIiBoZWlnaHQ9IjMwIiByeD0iNyIgc3Ryb2tlLXdpZHRoPSIxLjIiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMzgiIHk9IjEyOCIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6IzMzNDE1NSI+UmVjb246RUMyL1BvcnRzY2FuPC90ZXh0Pgo8dGV4dCB4PSIyNCIgeT0iMTY4IiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweDtmaWxsOiM2NDc0OGIiPmEgZml4ZWQgc2V0IG9mIEFXUy1zcGVjaWZpYyBmaW5kaW5nLXR5cGUgc3RyaW5nczwvdGV4dD4KPGxpbmUgeDE9IjM2NiIgeTE9IjkwIiB4Mj0iNDI4IiB5Mj0iOTAiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNnZGRjMykiIHN0eWxlPSJzdHJva2U6IzRmNDZlNSIvPgo8dGV4dCB4PSIzOTciIHk9IjgyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjhweCI+cmV2aWV3IHJ1bGVzPC90ZXh0Pgo8dGV4dCB4PSIzOTciIHk9IjEwNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo4cHgiPkRlZmVuZGVyIGFsZXJ0czwvdGV4dD4KPHRleHQgeD0iNDQwIiB5PSIyNiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzRmNDZlNSI+REVGRU5ERVIgRk9SIENMT1VEIEFMRVJUUyDCtyBJVFMgT1dOIEZBTUlMSUVTPC90ZXh0Pgo8cmVjdCB4PSI0NDAiIHk9IjM2IiB3aWR0aD0iMzcyIiBoZWlnaHQ9IjMwIiByeD0iNyIgc3Ryb2tlLXdpZHRoPSIxLjIiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNlZWYyZmYiLz4KPHRleHQgeD0iNDU0IiB5PSI1NiIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6IzMzNDE1NSI+QnJ1dGUtZm9yY2UgYXR0ZW1wdCBvbiBhIFZNIChTU0gpPC90ZXh0Pgo8dGV4dCB4PSI4MDAiIHk9IjU2IiB0ZXh0LWFuY2hvcj0iZW5kIiBzdHlsZT0iZm9udDogNjAwIDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZpbGw6IzRmNDZlNSI+aGlnaDwvdGV4dD4KPHJlY3QgeD0iNDQwIiB5PSI3MiIgd2lkdGg9IjM3MiIgaGVpZ2h0PSIzMCIgcng9IjciIHN0cm9rZS13aWR0aD0iMS4yIiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojZWVmMmZmIi8+Cjx0ZXh0IHg9IjQ1NCIgeT0iOTIiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6MTBweDtmaWxsOiMzMzQxNTUiPkNyeXB0by1taW5pbmcgYmVoYXZpb3IgZGV0ZWN0ZWQ8L3RleHQ+Cjx0ZXh0IHg9IjgwMCIgeT0iOTIiIHRleHQtYW5jaG9yPSJlbmQiIHN0eWxlPSJmb250OiA2MDAgMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZmlsbDojNGY0NmU1Ij5oaWdoPC90ZXh0Pgo8cmVjdCB4PSI0NDAiIHk9IjEwOCIgd2lkdGg9IjM3MiIgaGVpZ2h0PSIzMCIgcng9IjciIHN0cm9rZS13aWR0aD0iMS4yIiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojZWVmMmZmIi8+Cjx0ZXh0IHg9IjQ1NCIgeT0iMTI4IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjEwcHg7ZmlsbDojMzM0MTU1Ij5TdXNwZWN0ZWQgcG9ydCBzY2FubmluZzwvdGV4dD4KPHRleHQgeD0iODAwIiB5PSIxMjgiIHRleHQtYW5jaG9yPSJlbmQiIHN0eWxlPSJmb250OiA2MDAgMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZmlsbDojNGY0NmU1Ij5tZWRpdW08L3RleHQ+Cjx0ZXh0IHg9IjQ0MCIgeT0iMTY4IiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweDtmaWxsOiM2NDc0OGIiPml0cyBvd24gYWxlcnQgZmFtaWxpZXMsIGVhY2ggc2V2ZXJpdHktc2NvcmVkPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMTg4IiB3aWR0aD0iNzg4IiBoZWlnaHQ9IjQ4IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS4zIiBzdHlsZT0iZmlsbDojZmZmYmViO3N0cm9rZTojZmRlNjhhIi8+Cjx0ZXh0IHg9IjQwIiB5PSIyMTAiIHN0eWxlPSJmb250OjcwMCAxMC41cHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiNiNDUzMDkiPkZJTkRJTkcgTkFNRVMgRElGRkVSPC90ZXh0Pgo8dGV4dCB4PSI0MCIgeT0iMjI2IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjEwcHg7ZmlsbDojMzM0MTU1Ij5VcGRhdGUgcnVsZXMgdGhhdCBtYXRjaCBHdWFyZER1dHkgZmluZGluZy10eXBlIHN0cmluZ3MgdG8gdXNlIERlZmVuZGVyIGFsZXJ0IGZhbWlsaWVzLjwvdGV4dD4KPC9zdmc+)

![GuardDuty finding types such as UnauthorizedAccess:EC2/SSHBruteForce become Defender alerts with their own names and severities, such as a brute-force attempt on a VM. Rules that match GuardDuty names must be rewritten.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjUwIiB2aWV3Qm94PSIwIDAgODM2IDI1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJHdWFyZER1dHkgZmluZGluZyB0eXBlcyBzdWNoIGFzIFVuYXV0aG9yaXplZEFjY2VzczpFQzIvU1NIQnJ1dGVGb3JjZSBiZWNvbWUgRGVmZW5kZXIgYWxlcnRzIHdpdGggdGhlaXIgb3duIG5hbWVzIGFuZCBzZXZlcml0aWVzLCBzdWNoIGFzIGEgYnJ1dGUtZm9yY2UgYXR0ZW1wdCBvbiBhIFZNLiBSdWxlcyB0aGF0IG1hdGNoIEd1YXJkRHV0eSBuYW1lcyBtdXN0IGJlIHJld3JpdHRlbi4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0iZ2RkYzMiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6I2E1YjRmYyIvPjwvbWFya2VyPjwvZGVmcz4KPHRleHQgeD0iMjQiIHk9IjI2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojOTRhM2I4Ij5HVUFSRERVVFkgRklORElORyBUWVBFUyDCtyBBIEZJWEVEIENBVEFMT0c8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSIzNiIgd2lkdGg9IjMzMCIgaGVpZ2h0PSIzMCIgcng9IjciIHN0cm9rZS13aWR0aD0iMS4yIiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjM4IiB5PSI1NiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6I2NiZDVlMSI+VW5hdXRob3JpemVkQWNjZXNzOkVDMi9TU0hCcnV0ZUZvcmNlPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iNzIiIHdpZHRoPSIzMzAiIGhlaWdodD0iMzAiIHJ4PSI3IiBzdHJva2Utd2lkdGg9IjEuMiIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIzOCIgeT0iOTIiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmb250LXNpemU6MTBweDtmaWxsOiNjYmQ1ZTEiPkNyeXB0b0N1cnJlbmN5OkVDMi9CaXRjb2luVG9vbC5CPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMTA4IiB3aWR0aD0iMzMwIiBoZWlnaHQ9IjMwIiByeD0iNyIgc3Ryb2tlLXdpZHRoPSIxLjIiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMzgiIHk9IjEyOCIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6I2NiZDVlMSI+UmVjb246RUMyL1BvcnRzY2FuPC90ZXh0Pgo8dGV4dCB4PSIyNCIgeT0iMTY4IiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweDtmaWxsOiM5NGEzYjgiPmEgZml4ZWQgc2V0IG9mIEFXUy1zcGVjaWZpYyBmaW5kaW5nLXR5cGUgc3RyaW5nczwvdGV4dD4KPGxpbmUgeDE9IjM2NiIgeTE9IjkwIiB4Mj0iNDI4IiB5Mj0iOTAiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNnZGRjMykiIHN0eWxlPSJzdHJva2U6I2E1YjRmYyIvPgo8dGV4dCB4PSIzOTciIHk9IjgyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjhweCI+cmV2aWV3IHJ1bGVzPC90ZXh0Pgo8dGV4dCB4PSIzOTciIHk9IjEwNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo4cHgiPkRlZmVuZGVyIGFsZXJ0czwvdGV4dD4KPHRleHQgeD0iNDQwIiB5PSIyNiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6I2E1YjRmYyI+REVGRU5ERVIgRk9SIENMT1VEIEFMRVJUUyDCtyBJVFMgT1dOIEZBTUlMSUVTPC90ZXh0Pgo8cmVjdCB4PSI0NDAiIHk9IjM2IiB3aWR0aD0iMzcyIiBoZWlnaHQ9IjMwIiByeD0iNyIgc3Ryb2tlLXdpZHRoPSIxLjIiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiMxZTFiNGIiLz4KPHRleHQgeD0iNDU0IiB5PSI1NiIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6I2NiZDVlMSI+QnJ1dGUtZm9yY2UgYXR0ZW1wdCBvbiBhIFZNIChTU0gpPC90ZXh0Pgo8dGV4dCB4PSI4MDAiIHk9IjU2IiB0ZXh0LWFuY2hvcj0iZW5kIiBzdHlsZT0iZm9udDogNjAwIDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZpbGw6I2E1YjRmYyI+aGlnaDwvdGV4dD4KPHJlY3QgeD0iNDQwIiB5PSI3MiIgd2lkdGg9IjM3MiIgaGVpZ2h0PSIzMCIgcng9IjciIHN0cm9rZS13aWR0aD0iMS4yIiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojMWUxYjRiIi8+Cjx0ZXh0IHg9IjQ1NCIgeT0iOTIiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6MTBweDtmaWxsOiNjYmQ1ZTEiPkNyeXB0by1taW5pbmcgYmVoYXZpb3IgZGV0ZWN0ZWQ8L3RleHQ+Cjx0ZXh0IHg9IjgwMCIgeT0iOTIiIHRleHQtYW5jaG9yPSJlbmQiIHN0eWxlPSJmb250OiA2MDAgMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZmlsbDojYTViNGZjIj5oaWdoPC90ZXh0Pgo8cmVjdCB4PSI0NDAiIHk9IjEwOCIgd2lkdGg9IjM3MiIgaGVpZ2h0PSIzMCIgcng9IjciIHN0cm9rZS13aWR0aD0iMS4yIiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojMWUxYjRiIi8+Cjx0ZXh0IHg9IjQ1NCIgeT0iMTI4IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjEwcHg7ZmlsbDojY2JkNWUxIj5TdXNwZWN0ZWQgcG9ydCBzY2FubmluZzwvdGV4dD4KPHRleHQgeD0iODAwIiB5PSIxMjgiIHRleHQtYW5jaG9yPSJlbmQiIHN0eWxlPSJmb250OiA2MDAgMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZmlsbDojYTViNGZjIj5tZWRpdW08L3RleHQ+Cjx0ZXh0IHg9IjQ0MCIgeT0iMTY4IiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweDtmaWxsOiM5NGEzYjgiPml0cyBvd24gYWxlcnQgZmFtaWxpZXMsIGVhY2ggc2V2ZXJpdHktc2NvcmVkPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMTg4IiB3aWR0aD0iNzg4IiBoZWlnaHQ9IjQ4IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS4zIiBzdHlsZT0iZmlsbDojNDIyMDA2O3N0cm9rZTojOTI0MDBlIi8+Cjx0ZXh0IHg9IjQwIiB5PSIyMTAiIHN0eWxlPSJmb250OjcwMCAxMC41cHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiNmYmJmMjQiPkZJTkRJTkcgTkFNRVMgRElGRkVSPC90ZXh0Pgo8dGV4dCB4PSI0MCIgeT0iMjI2IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjEwcHg7ZmlsbDojY2JkNWUxIj5VcGRhdGUgcnVsZXMgdGhhdCBtYXRjaCBHdWFyZER1dHkgZmluZGluZy10eXBlIHN0cmluZ3MgdG8gdXNlIERlZmVuZGVyIGFsZXJ0IGZhbWlsaWVzLjwvdGV4dD4KPC9zdmc+)

Defender uses its own alert names. Rewrite each rule that matches a GuardDuty finding type.

#### Detection sources

Match server, storage, container and subscription-activity threats to the Defender protection that covers them. DNS protection is part of Defender for Servers; the older standalone Defender for DNS plan is not used for new deployments. Review the resources and signals actually protected for each GuardDuty use case.

Defender for Servers includes endpoint protection, and Plan 2 also offers agentless scanning, including malware scanning. Compare the selected subplan and scanning settings with the application's EBS malware requirements. Different scanning mechanisms do not imply identical detection. See [Microsoft's plan comparison](https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers-select-plan).

![Each GuardDuty detection source compared with the Azure telemetry and Defender protection that covers it: management events, flow logs, DNS, Kubernetes audit logs and malware scanning. Server malware protection has endpoint and agentless options with different coverage.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjM0IiB2aWV3Qm94PSIwIDAgODM2IDIzNCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJFYWNoIEd1YXJkRHV0eSBkZXRlY3Rpb24gc291cmNlIGNvbXBhcmVkIHdpdGggdGhlIEF6dXJlIHRlbGVtZXRyeSBhbmQgRGVmZW5kZXIgcHJvdGVjdGlvbiB0aGF0IGNvdmVycyBpdDogbWFuYWdlbWVudCBldmVudHMsIGZsb3cgbG9ncywgRE5TLCBLdWJlcm5ldGVzIGF1ZGl0IGxvZ3MgYW5kIG1hbHdhcmUgc2Nhbm5pbmcuIFNlcnZlciBtYWx3YXJlIHByb3RlY3Rpb24gaGFzIGVuZHBvaW50IGFuZCBhZ2VudGxlc3Mgb3B0aW9ucyB3aXRoIGRpZmZlcmVudCBjb3ZlcmFnZS4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT4KPHRleHQgeD0iMjQiIHk9IjI0IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojMzM0MTU1Ij5ERVRFQ1RJT04gU09VUkNFUyDCtyBHVUFSRERVVFkg4oaSIEFaVVJFIFRFTEVNRVRSWSDCtyBERUZFTkRFUiBQTEFOPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMzYiIHdpZHRoPSI3ODgiIGhlaWdodD0iMzQiIHJ4PSI3IiBzdHJva2Utd2lkdGg9IjEuMSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2Y4ZmFmYyIvPgo8dGV4dCB4PSIzOCIgeT0iNTciIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmb250LXNpemU6OS41cHg7ZmlsbDojNjQ3NDhiIj5DbG91ZFRyYWlsIG1hbmFnZW1lbnQgZXZlbnRzPC90ZXh0Pgo8dGV4dCB4PSIzMzAiIHk9IjU3IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjEwcHg7ZmlsbDojMzM0MTU1Ij5BY3Rpdml0eSBMb2cgwrcgUmVzb3VyY2UgTWFuYWdlciBvcHM8L3RleHQ+Cjx0ZXh0IHg9IjgwMCIgeT0iNTciIHRleHQtYW5jaG9yPSJlbmQiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OXB4O2ZpbGw6IzRmNDZlNSI+UmVzb3VyY2UgTWFuYWdlciBwcm90ZWN0aW9uPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iNzQiIHdpZHRoPSI3ODgiIGhlaWdodD0iMzQiIHJ4PSI3IiBzdHJva2Utd2lkdGg9IjEuMSIgc3R5bGU9ImZpbGw6I2ZmZmJlYjtzdHJva2U6I2ZkZTY4YSIvPgo8dGV4dCB4PSIzOCIgeT0iOTUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmb250LXNpemU6OS41cHg7ZmlsbDojNjQ3NDhiIj5WUEMgRmxvdyBMb2dzPC90ZXh0Pgo8dGV4dCB4PSIzMzAiIHk9Ijk1IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjEwcHg7ZmlsbDojMzM0MTU1Ij5OU0cgZmxvdyBsb2dzIMK3IGFnZW50IHRlbGVtZXRyeTwvdGV4dD4KPHRleHQgeD0iODAwIiB5PSI5NSIgdGV4dC1hbmNob3I9ImVuZCIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojYjQ1MzA5Ij5EZWZlbmRlciBmb3IgU2VydmVycyDCtyBwYXJ0aWFsPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMTEyIiB3aWR0aD0iNzg4IiBoZWlnaHQ9IjM0IiByeD0iNyIgc3Ryb2tlLXdpZHRoPSIxLjEiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNmOGZhZmMiLz4KPHRleHQgeD0iMzgiIHk9IjEzMyIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZvbnQtc2l6ZTo5LjVweDtmaWxsOiM2NDc0OGIiPkROUyBxdWVyeSBsb2dzPC90ZXh0Pgo8dGV4dCB4PSIzMzAiIHk9IjEzMyIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6IzMzNDE1NSI+QXp1cmUgRE5TIHJlc29sdmVyIGxvZ3M8L3RleHQ+Cjx0ZXh0IHg9IjgwMCIgeT0iMTMzIiB0ZXh0LWFuY2hvcj0iZW5kIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweDtmaWxsOiM0ZjQ2ZTUiPlNlcnZlcnMgRE5TIHByb3RlY3Rpb248L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSIxNTAiIHdpZHRoPSI3ODgiIGhlaWdodD0iMzQiIHJ4PSI3IiBzdHJva2Utd2lkdGg9IjEuMSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2Y4ZmFmYyIvPgo8dGV4dCB4PSIzOCIgeT0iMTcxIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZm9udC1zaXplOjkuNXB4O2ZpbGw6IzY0NzQ4YiI+RUtTIGF1ZGl0IGxvZ3M8L3RleHQ+Cjx0ZXh0IHg9IjMzMCIgeT0iMTcxIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjEwcHg7ZmlsbDojMzM0MTU1Ij5BS1MgYXVkaXQgwrcgcnVudGltZSBzaWduYWxzPC90ZXh0Pgo8dGV4dCB4PSI4MDAiIHk9IjE3MSIgdGV4dC1hbmNob3I9ImVuZCIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojNGY0NmU1Ij5EZWZlbmRlciBmb3IgQ29udGFpbmVyczwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjE4OCIgd2lkdGg9Ijc4OCIgaGVpZ2h0PSIzNCIgcng9IjciIHN0cm9rZS13aWR0aD0iMS4xIiBzdHlsZT0iZmlsbDojZmZmYmViO3N0cm9rZTojZmRlNjhhIi8+Cjx0ZXh0IHg9IjM4IiB5PSIyMDkiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmb250LXNpemU6OS41cHg7ZmlsbDojNjQ3NDhiIj5NYWx3YXJlIFByb3RlY3Rpb24gKEVCUyBzbmFwc2hvdCk8L3RleHQ+Cjx0ZXh0IHg9IjMzMCIgeT0iMjA5IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjEwcHg7ZmlsbDojMzM0MTU1Ij5ob3N0LWFnZW50IGVuZHBvaW50IHNjYW48L3RleHQ+Cjx0ZXh0IHg9IjgwMCIgeT0iMjA5IiB0ZXh0LWFuY2hvcj0iZW5kIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweDtmaWxsOiNiNDUzMDkiPlNlcnZlcnMgwrcgdmVyaWZ5IHNjYW5uaW5nIHNldHRpbmdzPC90ZXh0Pgo8L3N2Zz4=)

![Each GuardDuty detection source compared with the Azure telemetry and Defender protection that covers it: management events, flow logs, DNS, Kubernetes audit logs and malware scanning. Server malware protection has endpoint and agentless options with different coverage.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjM0IiB2aWV3Qm94PSIwIDAgODM2IDIzNCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJFYWNoIEd1YXJkRHV0eSBkZXRlY3Rpb24gc291cmNlIGNvbXBhcmVkIHdpdGggdGhlIEF6dXJlIHRlbGVtZXRyeSBhbmQgRGVmZW5kZXIgcHJvdGVjdGlvbiB0aGF0IGNvdmVycyBpdDogbWFuYWdlbWVudCBldmVudHMsIGZsb3cgbG9ncywgRE5TLCBLdWJlcm5ldGVzIGF1ZGl0IGxvZ3MgYW5kIG1hbHdhcmUgc2Nhbm5pbmcuIFNlcnZlciBtYWx3YXJlIHByb3RlY3Rpb24gaGFzIGVuZHBvaW50IGFuZCBhZ2VudGxlc3Mgb3B0aW9ucyB3aXRoIGRpZmZlcmVudCBjb3ZlcmFnZS4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT4KPHRleHQgeD0iMjQiIHk9IjI0IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojY2JkNWUxIj5ERVRFQ1RJT04gU09VUkNFUyDCtyBHVUFSRERVVFkg4oaSIEFaVVJFIFRFTEVNRVRSWSDCtyBERUZFTkRFUiBQTEFOPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMzYiIHdpZHRoPSI3ODgiIGhlaWdodD0iMzQiIHJ4PSI3IiBzdHJva2Utd2lkdGg9IjEuMSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzBmMTcyYSIvPgo8dGV4dCB4PSIzOCIgeT0iNTciIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmb250LXNpemU6OS41cHg7ZmlsbDojOTRhM2I4Ij5DbG91ZFRyYWlsIG1hbmFnZW1lbnQgZXZlbnRzPC90ZXh0Pgo8dGV4dCB4PSIzMzAiIHk9IjU3IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjEwcHg7ZmlsbDojY2JkNWUxIj5BY3Rpdml0eSBMb2cgwrcgUmVzb3VyY2UgTWFuYWdlciBvcHM8L3RleHQ+Cjx0ZXh0IHg9IjgwMCIgeT0iNTciIHRleHQtYW5jaG9yPSJlbmQiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OXB4O2ZpbGw6I2E1YjRmYyI+UmVzb3VyY2UgTWFuYWdlciBwcm90ZWN0aW9uPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iNzQiIHdpZHRoPSI3ODgiIGhlaWdodD0iMzQiIHJ4PSI3IiBzdHJva2Utd2lkdGg9IjEuMSIgc3R5bGU9ImZpbGw6IzQyMjAwNjtzdHJva2U6IzkyNDAwZSIvPgo8dGV4dCB4PSIzOCIgeT0iOTUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmb250LXNpemU6OS41cHg7ZmlsbDojOTRhM2I4Ij5WUEMgRmxvdyBMb2dzPC90ZXh0Pgo8dGV4dCB4PSIzMzAiIHk9Ijk1IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjEwcHg7ZmlsbDojY2JkNWUxIj5OU0cgZmxvdyBsb2dzIMK3IGFnZW50IHRlbGVtZXRyeTwvdGV4dD4KPHRleHQgeD0iODAwIiB5PSI5NSIgdGV4dC1hbmNob3I9ImVuZCIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojZmJiZjI0Ij5EZWZlbmRlciBmb3IgU2VydmVycyDCtyBwYXJ0aWFsPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMTEyIiB3aWR0aD0iNzg4IiBoZWlnaHQ9IjM0IiByeD0iNyIgc3Ryb2tlLXdpZHRoPSIxLjEiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiMwZjE3MmEiLz4KPHRleHQgeD0iMzgiIHk9IjEzMyIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZvbnQtc2l6ZTo5LjVweDtmaWxsOiM5NGEzYjgiPkROUyBxdWVyeSBsb2dzPC90ZXh0Pgo8dGV4dCB4PSIzMzAiIHk9IjEzMyIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6I2NiZDVlMSI+QXp1cmUgRE5TIHJlc29sdmVyIGxvZ3M8L3RleHQ+Cjx0ZXh0IHg9IjgwMCIgeT0iMTMzIiB0ZXh0LWFuY2hvcj0iZW5kIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweDtmaWxsOiNhNWI0ZmMiPlNlcnZlcnMgRE5TIHByb3RlY3Rpb248L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSIxNTAiIHdpZHRoPSI3ODgiIGhlaWdodD0iMzQiIHJ4PSI3IiBzdHJva2Utd2lkdGg9IjEuMSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzBmMTcyYSIvPgo8dGV4dCB4PSIzOCIgeT0iMTcxIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZm9udC1zaXplOjkuNXB4O2ZpbGw6Izk0YTNiOCI+RUtTIGF1ZGl0IGxvZ3M8L3RleHQ+Cjx0ZXh0IHg9IjMzMCIgeT0iMTcxIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjEwcHg7ZmlsbDojY2JkNWUxIj5BS1MgYXVkaXQgwrcgcnVudGltZSBzaWduYWxzPC90ZXh0Pgo8dGV4dCB4PSI4MDAiIHk9IjE3MSIgdGV4dC1hbmNob3I9ImVuZCIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojYTViNGZjIj5EZWZlbmRlciBmb3IgQ29udGFpbmVyczwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjE4OCIgd2lkdGg9Ijc4OCIgaGVpZ2h0PSIzNCIgcng9IjciIHN0cm9rZS13aWR0aD0iMS4xIiBzdHlsZT0iZmlsbDojNDIyMDA2O3N0cm9rZTojOTI0MDBlIi8+Cjx0ZXh0IHg9IjM4IiB5PSIyMDkiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmb250LXNpemU6OS41cHg7ZmlsbDojOTRhM2I4Ij5NYWx3YXJlIFByb3RlY3Rpb24gKEVCUyBzbmFwc2hvdCk8L3RleHQ+Cjx0ZXh0IHg9IjMzMCIgeT0iMjA5IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjEwcHg7ZmlsbDojY2JkNWUxIj5ob3N0LWFnZW50IGVuZHBvaW50IHNjYW48L3RleHQ+Cjx0ZXh0IHg9IjgwMCIgeT0iMjA5IiB0ZXh0LWFuY2hvcj0iZW5kIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweDtmaWxsOiNmYmJmMjQiPlNlcnZlcnMgwrcgdmVyaWZ5IHNjYW5uaW5nIHNldHRpbmdzPC90ZXh0Pgo8L3N2Zz4=)

Review each AWS detection requirement against the selected Azure protection and scanning settings.

#### Alerts and response

On AWS, GuardDuty findings can feed Security Hub and EventBridge. On Azure, Defender alerts can feed Microsoft Sentinel, a security information and event management (SIEM) service. Configure the connection, analytics rules and playbooks for the required responses.

Rewrite EventBridge filters against the relevant Defender alert names and test severity handling and response actions. Similar alert topics do not imply that the rule matches the same event or has the same false-positive behavior.

![On AWS, GuardDuty findings flow to Security Hub and EventBridge for automation. On Azure, Defender alerts flow to Microsoft Sentinel, where you configure analytics rules and playbooks.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTgwIiB2aWV3Qm94PSIwIDAgODM2IDE4MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MsIEd1YXJkRHV0eSBmaW5kaW5ncyBmbG93IHRvIFNlY3VyaXR5IEh1YiBhbmQgRXZlbnRCcmlkZ2UgZm9yIGF1dG9tYXRpb24uIE9uIEF6dXJlLCBEZWZlbmRlciBhbGVydHMgZmxvdyB0byBNaWNyb3NvZnQgU2VudGluZWwsIHdoZXJlIHlvdSBjb25maWd1cmUgYW5hbHl0aWNzIHJ1bGVzIGFuZCBwbGF5Ym9va3MuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImdkZGM1IiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM5NGEzYjgiLz48L21hcmtlcj48bWFya2VyIGlkPSJnZGRjNWIiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzRmNDZlNSIvPjwvbWFya2VyPjwvZGVmcz4KPHRleHQgeD0iMjQiIHk9IjI2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojNjQ3NDhiIj5PTiBBV1M8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSIzOCIgd2lkdGg9IjE1MCIgaGVpZ2h0PSI1OCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI5OSIgeT0iNjIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTAuNXB4Ij5HdWFyZER1dHkgZmluZGluZzwvdGV4dD4KPHRleHQgeD0iOTkiIHk9IjgwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweCI+c2V2ZXJpdHktc2NvcmVkPC90ZXh0Pgo8bGluZSB4MT0iMTc0IiB5MT0iNjciIHgyPSIyMDQiIHkyPSI2NyIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2dkZGM1KSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+CjxyZWN0IHg9IjIwOCIgeT0iMzgiIHdpZHRoPSIxNjgiIGhlaWdodD0iNTgiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMjkyIiB5PSI2MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMHB4Ij5TZWN1cml0eSBIdWIgwrcgRXZlbnRCcmlkZ2U8L3RleHQ+Cjx0ZXh0IHg9IjI5MiIgeT0iODAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OXB4Ij5mYW4tb3V0ICsgYXV0b21hdGlvbjwvdGV4dD4KPGxpbmUgeDE9IjQxOCIgeTE9IjM0IiB4Mj0iNDE4IiB5Mj0iMTUwIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9InN0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjQ1MiIgeT0iMjYiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiM0ZjQ2ZTUiPk9OIEFaVVJFPC90ZXh0Pgo8cmVjdCB4PSI0NTIiIHk9IjM4IiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjU4IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojNGY0NmU1Ii8+Cjx0ZXh0IHg9IjUyNyIgeT0iNjIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTAuNXB4O2ZpbGw6IzRmNDZlNSI+RGVmZW5kZXIgYWxlcnQ8L3RleHQ+Cjx0ZXh0IHg9IjUyNyIgeT0iODAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OXB4Ij5zZXZlcml0eS1zY29yZWQ8L3RleHQ+CjxsaW5lIHgxPSI2MDIiIHkxPSI2NyIgeDI9IjYzMiIgeTI9IjY3IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZ2RkYzViKSIgc3R5bGU9InN0cm9rZTojNGY0NmU1Ii8+CjxyZWN0IHg9IjYzNiIgeT0iMzgiIHdpZHRoPSIxNzYiIGhlaWdodD0iNTgiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiM0ZjQ2ZTUiLz4KPHRleHQgeD0iNzI0IiB5PSI2MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMC41cHg7ZmlsbDojNGY0NmU1Ij5NaWNyb3NvZnQgU2VudGluZWw8L3RleHQ+Cjx0ZXh0IHg9IjcyNCIgeT0iODAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OXB4Ij5hbmFseXRpY3MgcnVsZXMgwrcgcGxheWJvb2tzPC90ZXh0Pgo8dGV4dCB4PSI0MTgiIHk9IjEzMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojNjQ3NDhiIj5Db25maWd1cmUgU2VudGluZWwgYW5hbHl0aWNzIHJ1bGVzIGFuZCBwbGF5Ym9va3MgZm9yIERlZmVuZGVyIGFsZXJ0cy48L3RleHQ+Cjwvc3ZnPg==)

![On AWS, GuardDuty findings flow to Security Hub and EventBridge for automation. On Azure, Defender alerts flow to Microsoft Sentinel, where you configure analytics rules and playbooks.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTgwIiB2aWV3Qm94PSIwIDAgODM2IDE4MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MsIEd1YXJkRHV0eSBmaW5kaW5ncyBmbG93IHRvIFNlY3VyaXR5IEh1YiBhbmQgRXZlbnRCcmlkZ2UgZm9yIGF1dG9tYXRpb24uIE9uIEF6dXJlLCBEZWZlbmRlciBhbGVydHMgZmxvdyB0byBNaWNyb3NvZnQgU2VudGluZWwsIHdoZXJlIHlvdSBjb25maWd1cmUgYW5hbHl0aWNzIHJ1bGVzIGFuZCBwbGF5Ym9va3MuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImdkZGM1IiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM2NDc0OGIiLz48L21hcmtlcj48bWFya2VyIGlkPSJnZGRjNWIiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6I2E1YjRmYyIvPjwvbWFya2VyPjwvZGVmcz4KPHRleHQgeD0iMjQiIHk9IjI2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojOTRhM2I4Ij5PTiBBV1M8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSIzOCIgd2lkdGg9IjE1MCIgaGVpZ2h0PSI1OCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI5OSIgeT0iNjIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTAuNXB4Ij5HdWFyZER1dHkgZmluZGluZzwvdGV4dD4KPHRleHQgeD0iOTkiIHk9IjgwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweCI+c2V2ZXJpdHktc2NvcmVkPC90ZXh0Pgo8bGluZSB4MT0iMTc0IiB5MT0iNjciIHgyPSIyMDQiIHkyPSI2NyIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2dkZGM1KSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+CjxyZWN0IHg9IjIwOCIgeT0iMzgiIHdpZHRoPSIxNjgiIGhlaWdodD0iNTgiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMjkyIiB5PSI2MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMHB4Ij5TZWN1cml0eSBIdWIgwrcgRXZlbnRCcmlkZ2U8L3RleHQ+Cjx0ZXh0IHg9IjI5MiIgeT0iODAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OXB4Ij5mYW4tb3V0ICsgYXV0b21hdGlvbjwvdGV4dD4KPGxpbmUgeDE9IjQxOCIgeTE9IjM0IiB4Mj0iNDE4IiB5Mj0iMTUwIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9InN0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjQ1MiIgeT0iMjYiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiNhNWI0ZmMiPk9OIEFaVVJFPC90ZXh0Pgo8cmVjdCB4PSI0NTIiIHk9IjM4IiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjU4IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojYTViNGZjIi8+Cjx0ZXh0IHg9IjUyNyIgeT0iNjIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTAuNXB4O2ZpbGw6I2E1YjRmYyI+RGVmZW5kZXIgYWxlcnQ8L3RleHQ+Cjx0ZXh0IHg9IjUyNyIgeT0iODAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OXB4Ij5zZXZlcml0eS1zY29yZWQ8L3RleHQ+CjxsaW5lIHgxPSI2MDIiIHkxPSI2NyIgeDI9IjYzMiIgeTI9IjY3IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZ2RkYzViKSIgc3R5bGU9InN0cm9rZTojYTViNGZjIi8+CjxyZWN0IHg9IjYzNiIgeT0iMzgiIHdpZHRoPSIxNzYiIGhlaWdodD0iNTgiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiNhNWI0ZmMiLz4KPHRleHQgeD0iNzI0IiB5PSI2MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMC41cHg7ZmlsbDojYTViNGZjIj5NaWNyb3NvZnQgU2VudGluZWw8L3RleHQ+Cjx0ZXh0IHg9IjcyNCIgeT0iODAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OXB4Ij5hbmFseXRpY3MgcnVsZXMgwrcgcGxheWJvb2tzPC90ZXh0Pgo8dGV4dCB4PSI0MTgiIHk9IjEzMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojOTRhM2I4Ij5Db25maWd1cmUgU2VudGluZWwgYW5hbHl0aWNzIHJ1bGVzIGFuZCBwbGF5Ym9va3MgZm9yIERlZmVuZGVyIGFsZXJ0cy48L3RleHQ+Cjwvc3ZnPg==)

A configured Sentinel connection receives Defender alerts for analytics rules and response playbooks.

#### Limitations

Where Defender for Cloud and GuardDuty differ

* **Only the Servers and Storage plans are turned on for you.** Tensor9 does not turn on Containers, Resource Manager or other Defender protection, agents or scanning extensions. Select them as needed and review effective coverage in the subscription.
* **Finding names behave differently: rules that match GuardDuty names stop matching.** Rules matching identifiers such as `UnauthorizedAccess:EC2/SSHBruteForce` or `CryptoCurrency:*` must be rewritten for Defender's alert names and behaviour.
* **GuardDuty filters, IP sets, threat feeds and publishing destinations are not recreated.** The build reports each `aws_guardduty_filter`, `aws_guardduty_ipset`, `aws_guardduty_threatintelset` and `aws_guardduty_publishing_destination` it does not transfer. Re-create the suppression, allowlists, feeds and export you need in Azure.
* **You must turn on protection for S3 data events, EKS audit logs and malware scanning.** If your detector uses these sources, the build reports a warning for each one. Enable and check the matching Defender protection.
* **Network and malware detection behave differently.** Similar plan names do not mean every GuardDuty network finding or EBS malware scenario is detected. Check active subplans, extensions and workload settings.

#### Other considerations

* **Subscription scope and cost.** The plans apply to the whole subscription; review their scope and cost there. Historical GuardDuty findings are not migrated.
* **Further protection.** Configure protection beyond Servers and Storage yourself. Defender plan names and availability change, so use current Microsoft documentation when you choose.
* **Sentinel.** Configure the alert connection, analytics rules and playbooks, then test the responses your application needs.
* **Outputs keep working.** Terraform outputs that read the detector's `id`, `arn` or `account_id` still resolve; they return the detector's name.

## On Google Cloud

### Security Command Center

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| Account activity threat detection (CloudTrail analysis) | Detection sources | Supported | Common | Event Threat Detection analyzes supported Google Cloud audit logs. Its events and finding categories differ from GuardDuty's CloudTrail findings. |
| DNS threat detection (DNS query-log analysis) | Detection sources | Supported | Most usage | Event Threat Detection can analyze supported DNS logs. Its detector rules differ from GuardDuty's DNS finding catalog. |
| Kubernetes audit-log threat detection (EKS) | Detection sources | Supported | Most usage | Event Threat Detection analyzes supported GKE audit logs; Container Threat Detection covers runtime signals. Coverage differs from GuardDuty's EKS rules. |
| Malware Protection (EBS volume scan) | Detection sources | Partial | Full surface | Virtual Machine Threat Detection uses a different scanning mechanism from GuardDuty's EBS volume scanning; compare the malware coverage your workload needs. |
| Network threat detection (VPC Flow Log analysis) | Detection sources | Supported | Most usage | Google Cloud network-threat detection uses its supported network telemetry. Configure the required logs and review which GuardDuty detections have an equivalent. |
| Detector enablement (SCC Event Threat Detection) | Detector | Supported | Common | Maps to Security Command Center's managed threat detectors, including Event Threat Detection. The required services and logging must be enabled; a custom finding source alone does not enable detection. |
| Detector-set tier gating | Detector | Partial | Full surface | Detector availability depends on the Security Command Center service tier and enabled modules. Choose the services and log sources required for the intended coverage. |
| GuardDuty finding-type catalog | Findings | Out of scope | Full surface | GuardDuty finding-type strings do not map one-for-one to Security Command Center categories. Update automations that match specific AWS finding names. |
| SIEM / event fan-out | Findings | Supported | Common | Findings can be exported to Pub/Sub and integrated with Google SecOps. Adapt response rules to the backend's finding schema. |
| Severity-scored findings | Findings | Supported | Common | Security Command Center produces severity-scored findings with Google Cloud categories. They are not GuardDuty finding types. |
| Finding filters (aws\_guardduty\_filter) | Suppression + lists | Out of scope | Full surface | GuardDuty filters do not translate directly into Security Command Center mute rules. Review and recreate required suppression. |
| Threat-intel sets (aws\_guardduty\_threatintelset) | Suppression + lists | Out of scope | Full surface | GuardDuty threat-intelligence feeds require backend-specific configuration; they are not copied directly. |
| Trusted IP sets (aws\_guardduty\_ipset) | Suppression + lists | Out of scope | Full surface | GuardDuty trusted-IP lists require backend-specific configuration; they are not copied directly. |

#### How it works

On Google Cloud, GuardDuty maps to Security Command Center (SCC) threat detection. When Tensor9 builds the deployment it creates one SCC source, "Tensor9 GuardDuty Equivalent", in your Google Cloud organization. Google runs detection over your resources and produces findings with severity levels. This is a best-effort match between different security products, so review each threat scenario you depend on.

Event Threat Detection analyzes supported logs; other SCC services cover container and VM threats. You turn on the services and log inputs in your organization or projects, and connect findings to Pub/Sub or Google SecOps. GuardDuty filters and response rules must be rewritten for SCC.

![On AWS, GuardDuty analyzes AWS telemetry and reports severity-scored findings. On Google Cloud, Security Command Center detectors such as Event Threat Detection analyze Google Cloud logs, and findings can be exported to Pub/Sub. You turn on the detectors and the export.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjEwIiB2aWV3Qm94PSIwIDAgODM2IDIxMCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MsIEd1YXJkRHV0eSBhbmFseXplcyBBV1MgdGVsZW1ldHJ5IGFuZCByZXBvcnRzIHNldmVyaXR5LXNjb3JlZCBmaW5kaW5ncy4gT24gR29vZ2xlIENsb3VkLCBTZWN1cml0eSBDb21tYW5kIENlbnRlciBkZXRlY3RvcnMgc3VjaCBhcyBFdmVudCBUaHJlYXQgRGV0ZWN0aW9uIGFuYWx5emUgR29vZ2xlIENsb3VkIGxvZ3MsIGFuZCBmaW5kaW5ncyBjYW4gYmUgZXhwb3J0ZWQgdG8gUHViL1N1Yi4gWW91IHR1cm4gb24gdGhlIGRldGVjdG9ycyBhbmQgdGhlIGV4cG9ydC4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0iZ2RzY2MxIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM5NGEzYjgiLz48L21hcmtlcj48bWFya2VyIGlkPSJnZHNjYzFiIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM0ZjQ2ZTUiLz48L21hcmtlcj48L2RlZnM+CjxyZWN0IHg9IjE2IiB5PSI0MCIgd2lkdGg9IjM4NCIgaGVpZ2h0PSIxNTIiIHJ4PSIxNCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIzMCIgeT0iNjAiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiM2NDc0OGIiPk9OIEFXUyBUT0RBWTwvdGV4dD4KPHJlY3QgeD0iMjgiIHk9Ijc2IiB3aWR0aD0iMTIwIiBoZWlnaHQ9Ijk2IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9Ijg4IiB5PSIxMTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTFweCI+QVdTIHRlbGVtZXRyeTwvdGV4dD4KPHRleHQgeD0iODgiIHk9IjEzMCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5cHgiPkNsb3VkVHJhaWwgwrcgVlBDIEZsb3c8L3RleHQ+Cjx0ZXh0IHg9Ijg4IiB5PSIxNDQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OXB4Ij5ETlMgwrcgRUtTIMK3IFMzPC90ZXh0Pgo8bGluZSB4MT0iMTQ4IiB5MT0iMTI0IiB4Mj0iMTcwIiB5Mj0iMTI0IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZ2RzY2MxKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+CjxyZWN0IHg9IjE3MiIgeT0iOTQiIHdpZHRoPSIxMTIiIGhlaWdodD0iNjAiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMjI4IiB5PSIxMjAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTEuNXB4Ij5HdWFyZER1dHk8L3RleHQ+Cjx0ZXh0IHg9IjIyOCIgeT0iMTM2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjkuNXB4Ij5vbmUgZGV0ZWN0b3I8L3RleHQ+CjxsaW5lIHgxPSIyODQiIHkxPSIxMjQiIHgyPSIzMDYiIHkyPSIxMjQiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNnZHNjYzEpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHJlY3QgeD0iMzA4IiB5PSI5NCIgd2lkdGg9Ijg0IiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjM1MCIgeT0iMTIwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjEwLjVweCI+RmluZGluZ3M8L3RleHQ+Cjx0ZXh0IHg9IjM1MCIgeT0iMTM2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweCI+c2V2ZXJpdHktc2NvcmVkPC90ZXh0Pgo8bGluZSB4MT0iNDE4IiB5MT0iNDYiIHgyPSI0MTgiIHkyPSIxODYiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0ic3Ryb2tlOiNjYmQ1ZTEiLz4KPHJlY3QgeD0iNDM2IiB5PSI0MCIgd2lkdGg9IjM4NCIgaGVpZ2h0PSIxNTIiIHJ4PSIxNCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI0NTAiIHk9IjYwIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojMDQ3ODU3Ij5PTiBHQ1A8L3RleHQ+CjxyZWN0IHg9IjQ0OCIgeT0iNzYiIHdpZHRoPSIxMTYiIGhlaWdodD0iOTYiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNTA2IiB5PSIxMTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTAuNXB4Ij5HQ1AgdGVsZW1ldHJ5PC90ZXh0Pgo8dGV4dCB4PSI1MDYiIHk9IjEzMCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5cHgiPkF1ZGl0IExvZ3MgwrcgVlBDIEZsb3c8L3RleHQ+Cjx0ZXh0IHg9IjUwNiIgeT0iMTQ0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweCI+Q2xvdWQgRE5TIMK3IEdLRTwvdGV4dD4KPGxpbmUgeDE9IjU2NCIgeTE9IjEyNCIgeDI9IjU4NiIgeTI9IjEyNCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2dkc2NjMWIpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHJlY3QgeD0iNTg4IiB5PSI5MCIgd2lkdGg9IjE0MCIgaGVpZ2h0PSI2OCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNiIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6IzRmNDZlNSIvPgo8dGV4dCB4PSI2NTgiIHk9IjExMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZTo5LjVweDtmaWxsOiM0ZjQ2ZTUiPlNlY3VyaXR5IENvbW1hbmQgQ2VudGVyPC90ZXh0Pgo8dGV4dCB4PSI2NTgiIHk9IjEyOCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo4LjVweCI+RXZlbnQgVGhyZWF0IERldGVjdGlvbjwvdGV4dD4KPHRleHQgeD0iNjU4IiB5PSIxNDQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2MDAgMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NyI+Y29uZmlndXJlIGRldGVjdG9yczwvdGV4dD4KPGxpbmUgeDE9IjcyOCIgeTE9IjEyNCIgeDI9Ijc0OCIgeTI9IjEyNCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2dkc2NjMWIpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHJlY3QgeD0iNzUwIiB5PSI5NCIgd2lkdGg9IjY2IiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9Ijc4MyIgeT0iMTE4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjkuNXB4Ij5GaW5kaW5nczwvdGV4dD4KPHRleHQgeD0iNzgzIiB5PSIxMzQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OC41cHgiPuKGkiBQdWIvU3ViPC90ZXh0Pgo8dGV4dCB4PSI2MjgiIHk9IjE4MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojMDQ3ODU3Ij5Db25maWd1cmUgZGV0ZWN0aW9uIHNlcnZpY2VzIGFuZCBmaW5kaW5nIGV4cG9ydDwvdGV4dD4KPC9zdmc+)

![On AWS, GuardDuty analyzes AWS telemetry and reports severity-scored findings. On Google Cloud, Security Command Center detectors such as Event Threat Detection analyze Google Cloud logs, and findings can be exported to Pub/Sub. You turn on the detectors and the export.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjEwIiB2aWV3Qm94PSIwIDAgODM2IDIxMCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MsIEd1YXJkRHV0eSBhbmFseXplcyBBV1MgdGVsZW1ldHJ5IGFuZCByZXBvcnRzIHNldmVyaXR5LXNjb3JlZCBmaW5kaW5ncy4gT24gR29vZ2xlIENsb3VkLCBTZWN1cml0eSBDb21tYW5kIENlbnRlciBkZXRlY3RvcnMgc3VjaCBhcyBFdmVudCBUaHJlYXQgRGV0ZWN0aW9uIGFuYWx5emUgR29vZ2xlIENsb3VkIGxvZ3MsIGFuZCBmaW5kaW5ncyBjYW4gYmUgZXhwb3J0ZWQgdG8gUHViL1N1Yi4gWW91IHR1cm4gb24gdGhlIGRldGVjdG9ycyBhbmQgdGhlIGV4cG9ydC4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0iZ2RzY2MxIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM2NDc0OGIiLz48L21hcmtlcj48bWFya2VyIGlkPSJnZHNjYzFiIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiNhNWI0ZmMiLz48L21hcmtlcj48L2RlZnM+CjxyZWN0IHg9IjE2IiB5PSI0MCIgd2lkdGg9IjM4NCIgaGVpZ2h0PSIxNTIiIHJ4PSIxNCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIzMCIgeT0iNjAiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiM5NGEzYjgiPk9OIEFXUyBUT0RBWTwvdGV4dD4KPHJlY3QgeD0iMjgiIHk9Ijc2IiB3aWR0aD0iMTIwIiBoZWlnaHQ9Ijk2IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9Ijg4IiB5PSIxMTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTFweCI+QVdTIHRlbGVtZXRyeTwvdGV4dD4KPHRleHQgeD0iODgiIHk9IjEzMCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5cHgiPkNsb3VkVHJhaWwgwrcgVlBDIEZsb3c8L3RleHQ+Cjx0ZXh0IHg9Ijg4IiB5PSIxNDQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OXB4Ij5ETlMgwrcgRUtTIMK3IFMzPC90ZXh0Pgo8bGluZSB4MT0iMTQ4IiB5MT0iMTI0IiB4Mj0iMTcwIiB5Mj0iMTI0IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZ2RzY2MxKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+CjxyZWN0IHg9IjE3MiIgeT0iOTQiIHdpZHRoPSIxMTIiIGhlaWdodD0iNjAiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMjI4IiB5PSIxMjAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTEuNXB4Ij5HdWFyZER1dHk8L3RleHQ+Cjx0ZXh0IHg9IjIyOCIgeT0iMTM2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjkuNXB4Ij5vbmUgZGV0ZWN0b3I8L3RleHQ+CjxsaW5lIHgxPSIyODQiIHkxPSIxMjQiIHgyPSIzMDYiIHkyPSIxMjQiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNnZHNjYzEpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHJlY3QgeD0iMzA4IiB5PSI5NCIgd2lkdGg9Ijg0IiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjM1MCIgeT0iMTIwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjEwLjVweCI+RmluZGluZ3M8L3RleHQ+Cjx0ZXh0IHg9IjM1MCIgeT0iMTM2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweCI+c2V2ZXJpdHktc2NvcmVkPC90ZXh0Pgo8bGluZSB4MT0iNDE4IiB5MT0iNDYiIHgyPSI0MTgiIHkyPSIxODYiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0ic3Ryb2tlOiM0NzU1NjkiLz4KPHJlY3QgeD0iNDM2IiB5PSI0MCIgd2lkdGg9IjM4NCIgaGVpZ2h0PSIxNTIiIHJ4PSIxNCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI0NTAiIHk9IjYwIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojNmVlN2I3Ij5PTiBHQ1A8L3RleHQ+CjxyZWN0IHg9IjQ0OCIgeT0iNzYiIHdpZHRoPSIxMTYiIGhlaWdodD0iOTYiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNTA2IiB5PSIxMTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTAuNXB4Ij5HQ1AgdGVsZW1ldHJ5PC90ZXh0Pgo8dGV4dCB4PSI1MDYiIHk9IjEzMCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5cHgiPkF1ZGl0IExvZ3MgwrcgVlBDIEZsb3c8L3RleHQ+Cjx0ZXh0IHg9IjUwNiIgeT0iMTQ0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweCI+Q2xvdWQgRE5TIMK3IEdLRTwvdGV4dD4KPGxpbmUgeDE9IjU2NCIgeTE9IjEyNCIgeDI9IjU4NiIgeTI9IjEyNCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2dkc2NjMWIpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHJlY3QgeD0iNTg4IiB5PSI5MCIgd2lkdGg9IjE0MCIgaGVpZ2h0PSI2OCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNiIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6I2E1YjRmYyIvPgo8dGV4dCB4PSI2NTgiIHk9IjExMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZTo5LjVweDtmaWxsOiNhNWI0ZmMiPlNlY3VyaXR5IENvbW1hbmQgQ2VudGVyPC90ZXh0Pgo8dGV4dCB4PSI2NTgiIHk9IjEyOCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo4LjVweCI+RXZlbnQgVGhyZWF0IERldGVjdGlvbjwvdGV4dD4KPHRleHQgeD0iNjU4IiB5PSIxNDQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2MDAgMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNyI+Y29uZmlndXJlIGRldGVjdG9yczwvdGV4dD4KPGxpbmUgeDE9IjcyOCIgeTE9IjEyNCIgeDI9Ijc0OCIgeTI9IjEyNCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2dkc2NjMWIpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHJlY3QgeD0iNzUwIiB5PSI5NCIgd2lkdGg9IjY2IiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9Ijc4MyIgeT0iMTE4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjkuNXB4Ij5GaW5kaW5nczwvdGV4dD4KPHRleHQgeD0iNzgzIiB5PSIxMzQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OC41cHgiPuKGkiBQdWIvU3ViPC90ZXh0Pgo8dGV4dCB4PSI2MjgiIHk9IjE4MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojNmVlN2I3Ij5Db25maWd1cmUgZGV0ZWN0aW9uIHNlcnZpY2VzIGFuZCBmaW5kaW5nIGV4cG9ydDwvdGV4dD4KPC9zdmc+)

Security Command Center detectors analyze Google Cloud logs; you turn them on and export their findings.

#### What you configure in SCC

The SCC source Tensor9 creates records the posture; it does not turn on Event Threat Detection. You switch that on in SCC's settings, at the Premium or Enterprise tier, for your organization or projects. The detectors you choose decide which logs and which service tier you need. GuardDuty's feature toggles map to this configuration, not to one identical Google detector.

Turn on the logs and finding exports you need, then test the response rules that read SCC findings. [Google's service list](https://docs.cloud.google.com/security-command-center/docs/concepts-security-sources) describes the detectors available for each workload.

![SCC services are configured for your organization or projects; the detectors you choose decide which logs and service tier you need, and findings feed your export and alert rules.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjEyIiB2aWV3Qm94PSIwIDAgODM2IDIxMiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJTQ0Mgc2VydmljZXMgYXJlIGNvbmZpZ3VyZWQgZm9yIHlvdXIgb3JnYW5pemF0aW9uIG9yIHByb2plY3RzOyB0aGUgZGV0ZWN0b3JzIHlvdSBjaG9vc2UgZGVjaWRlIHdoaWNoIGxvZ3MgYW5kIHNlcnZpY2UgdGllciB5b3UgbmVlZCwgYW5kIGZpbmRpbmdzIGZlZWQgeW91ciBleHBvcnQgYW5kIGFsZXJ0IHJ1bGVzLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJnZHNjYzIiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6Izk0YTNiOCIvPjwvbWFya2VyPjwvZGVmcz4KPHJlY3QgeD0iMjQiIHk9IjY2IiB3aWR0aD0iMjA2IiBoZWlnaHQ9Ijg2IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjEyNyIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTJweCI+Q3VzdG9tZXIgc2NvcGU8L3RleHQ+Cjx0ZXh0IHg9IjEyNyIgeT0iMTE0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+b3JnYW5pemF0aW9uIC8gcHJvamVjdHM8L3RleHQ+Cjx0ZXh0IHg9IjEyNyIgeT0iMTMwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+cHJvdGVjdGVkIHdvcmtsb2FkczwvdGV4dD4KPGxpbmUgeDE9IjIzNCIgeTE9IjEwOSIgeDI9IjI5NiIgeTI9IjEwOSIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2dkc2NjMikiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSIzMDAiIHk9IjQ4IiB3aWR0aD0iMjMyIiBoZWlnaHQ9IjEyMiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8c3ZnIHg9IjMxMCIgeT0iNzciIHdpZHRoPSIxNiIgaGVpZ2h0PSIxNiIgdmlld0JveD0iMCAtMjUgMjU2IDI1NiIgcHJlc2VydmVBc3BlY3RSYXRpbz0ieE1pZFlNaWQgbWVldCI+PGc+IDxwYXRoIGQ9Ik0xNzAuMjUxNyw1Ni44MTg2IEwxOTIuNTA0NywzNC41NjU2IEwxOTMuOTg3NywyNS4xOTU2IEMxNTMuNDM2NywtMTEuNjc3NCA4OC45NzU3LC03LjQ5NjQgNTIuNDIwNywzMy45MTk2IEM0Mi4yNjY3LDQ1LjQyMjYgMzQuNzMzNyw1OS43NjM2IDMwLjcxNjcsNzQuNTcyNiBMMzguNjg2Nyw3My40NDk2IEw4My4xOTE3LDY2LjExMDYgTDg2LjYyNzcsNjIuNTk2NiBDMTA2LjQyNDcsNDAuODU0NiAxMzkuODk3NywzNy45Mjk2IDE2Mi43NTU3LDU2LjQyODYgTDE3MC4yNTE3LDU2LjgxODYgWiIgZmlsbD0iI0VBNDMzNSI+IDwvcGF0aD4gPHBhdGggZD0iTTIyNC4yMDQ4LDczLjkxODIgQzIxOS4wODk4LDU1LjA4MjIgMjA4LjU4ODgsMzguMTQ5MiAxOTMuOTg3OCwyNS4xOTYyIEwxNjIuNzU1OCw1Ni40MjgyIEMxNzUuOTQzOCw2Ny4yMDQyIDE4My40NTY4LDgzLjQzODIgMTgzLjEzNDgsMTAwLjQ2NTIgTDE4My4xMzQ4LDEwNi4wMDkyIEMxOTguNDg1OCwxMDYuMDA5MiAyMTAuOTMxOCwxMTguNDU0MiAyMTAuOTMxOCwxMzMuODA1MiBDMjEwLjkzMTgsMTQ5LjE1NzIgMTk4LjQ4NTgsMTYxLjI5MDIgMTgzLjEzNDgsMTYxLjI5MDIgTDEyNy40NjM4LDE2MS4yOTAyIEwxMjEuOTk3OCwxNjcuMjI0MiBMMTIxLjk5NzgsMjAwLjU2NDIgTDEyNy40NjM4LDIwNS43OTUyIEwxODMuMTM0OCwyMDUuNzk1MiBDMjIzLjA2NDgsMjA2LjEwNjIgMjU1LjY4NjgsMTc0LjMwMTIgMjU1Ljk5NzgsMTM0LjM3MTIgQzI1Ni4xODU4LDExMC4xNjgyIDI0NC4yNTI4LDg3LjQ3ODIgMjI0LjIwNDgsNzMuOTE4MiIgZmlsbD0iIzQyODVGNCI+IDwvcGF0aD4gPHBhdGggZD0iTTcxLjg3MDQsMjA1Ljc5NTcgTDEyNy40NjM0LDIwNS43OTU3IEwxMjcuNDYzNCwxNjEuMjg5NyBMNzEuODcwNCwxNjEuMjg5NyBDNjcuOTA5NCwxNjEuMjg4NyA2NC4wNzM0LDE2MC40Mzc3IDYwLjQ3MTQsMTU4Ljc5MTcgTDUyLjU4NDQsMTYxLjIxMTcgTDMwLjE3NTQsMTgzLjQ2NDcgTDI4LjIyMzQsMTkxLjAzODcgQzQwLjc5MDQsMjAwLjUyNzcgNTYuMTIzNCwyMDUuODYzNyA3MS44NzA0LDIwNS43OTU3IiBmaWxsPSIjMzRBODUzIj4gPC9wYXRoPiA8cGF0aCBkPSJNNzEuODcwNCw2MS40MjU1IEMzMS45Mzk0LDYxLjY2MzUgLTAuMjM2Niw5NC4yMjc1IDAuMDAxNCwxMzQuMTU3NSBDMC4xMzQ0LDE1Ni40NTU1IDEwLjU0ODQsMTc3LjQ0NTUgMjguMjIzNCwxOTEuMDM4NSBMNjAuNDcxNCwxNTguNzkxNSBDNDYuNDgwNCwxNTIuNDcwNSA0MC4yNjM0LDEzNi4wMDU1IDQ2LjU4NDQsMTIyLjAxNTUgQzUyLjkwNDQsMTA4LjAyNTUgNjkuMzcwNCwxMDEuODA4NSA4My4zNTk0LDEwOC4xMjg1IEM4OS41MjQ0LDExMC45MTM1IDk0LjQ2MTQsMTE1Ljg1MTUgOTcuMjQ2NCwxMjIuMDE1NSBMMTI5LjQ5NDQsODkuNzY4NSBDMTE1Ljc3MzQsNzEuODMxNSA5NC40NTM0LDYxLjM0NDUgNzEuODcwNCw2MS40MjU1IiBmaWxsPSIjRkJCQzA1Ij4gPC9wYXRoPiA8L2c+PC9zdmc+Cjx0ZXh0IHg9IjQxNiIgeT0iOTAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTJweCI+U0NDIHNlcnZpY2VzPC90ZXh0Pgo8dGV4dCB4PSI0MTYiIHk9IjEwNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPmRldGVjdG9yIHNldHRpbmdzPC90ZXh0Pgo8dGV4dCB4PSI0MTYiIHk9IjEyMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPnJlcXVpcmVkIGxvZyBpbnB1dHM8L3RleHQ+Cjx0ZXh0IHg9IjQxNiIgeT0iMTM4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+c2VydmljZSB0aWVyPC90ZXh0Pgo8bGluZSB4MT0iNTM2IiB5MT0iMTA5IiB4Mj0iNTkyIiB5Mj0iMTA5IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZ2RzY2MyKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+CjxyZWN0IHg9IjU5NiIgeT0iNjYiIHdpZHRoPSIyMTYiIGhlaWdodD0iODYiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNzA0IiB5PSI5OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMnB4Ij5GaW5kaW5ncyBhbmQgcmVzcG9uc2U8L3RleHQ+Cjx0ZXh0IHg9IjcwNCIgeT0iMTE0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+Y2F0ZWdvcmllcyArIHNldmVyaXR5PC90ZXh0Pgo8dGV4dCB4PSI3MDQiIHk9IjEzMCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPmV4cG9ydCBhbmQgYWxlcnQgcnVsZXM8L3RleHQ+Cjwvc3ZnPg==)

![SCC services are configured for your organization or projects; the detectors you choose decide which logs and service tier you need, and findings feed your export and alert rules.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjEyIiB2aWV3Qm94PSIwIDAgODM2IDIxMiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJTQ0Mgc2VydmljZXMgYXJlIGNvbmZpZ3VyZWQgZm9yIHlvdXIgb3JnYW5pemF0aW9uIG9yIHByb2plY3RzOyB0aGUgZGV0ZWN0b3JzIHlvdSBjaG9vc2UgZGVjaWRlIHdoaWNoIGxvZ3MgYW5kIHNlcnZpY2UgdGllciB5b3UgbmVlZCwgYW5kIGZpbmRpbmdzIGZlZWQgeW91ciBleHBvcnQgYW5kIGFsZXJ0IHJ1bGVzLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJnZHNjYzIiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzY0NzQ4YiIvPjwvbWFya2VyPjwvZGVmcz4KPHJlY3QgeD0iMjQiIHk9IjY2IiB3aWR0aD0iMjA2IiBoZWlnaHQ9Ijg2IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjEyNyIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTJweCI+Q3VzdG9tZXIgc2NvcGU8L3RleHQ+Cjx0ZXh0IHg9IjEyNyIgeT0iMTE0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+b3JnYW5pemF0aW9uIC8gcHJvamVjdHM8L3RleHQ+Cjx0ZXh0IHg9IjEyNyIgeT0iMTMwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+cHJvdGVjdGVkIHdvcmtsb2FkczwvdGV4dD4KPGxpbmUgeDE9IjIzNCIgeTE9IjEwOSIgeDI9IjI5NiIgeTI9IjEwOSIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2dkc2NjMikiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSIzMDAiIHk9IjQ4IiB3aWR0aD0iMjMyIiBoZWlnaHQ9IjEyMiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8c3ZnIHg9IjMxMCIgeT0iNzciIHdpZHRoPSIxNiIgaGVpZ2h0PSIxNiIgdmlld0JveD0iMCAtMjUgMjU2IDI1NiIgcHJlc2VydmVBc3BlY3RSYXRpbz0ieE1pZFlNaWQgbWVldCI+PGc+IDxwYXRoIGQ9Ik0xNzAuMjUxNyw1Ni44MTg2IEwxOTIuNTA0NywzNC41NjU2IEwxOTMuOTg3NywyNS4xOTU2IEMxNTMuNDM2NywtMTEuNjc3NCA4OC45NzU3LC03LjQ5NjQgNTIuNDIwNywzMy45MTk2IEM0Mi4yNjY3LDQ1LjQyMjYgMzQuNzMzNyw1OS43NjM2IDMwLjcxNjcsNzQuNTcyNiBMMzguNjg2Nyw3My40NDk2IEw4My4xOTE3LDY2LjExMDYgTDg2LjYyNzcsNjIuNTk2NiBDMTA2LjQyNDcsNDAuODU0NiAxMzkuODk3NywzNy45Mjk2IDE2Mi43NTU3LDU2LjQyODYgTDE3MC4yNTE3LDU2LjgxODYgWiIgZmlsbD0iI0VBNDMzNSI+IDwvcGF0aD4gPHBhdGggZD0iTTIyNC4yMDQ4LDczLjkxODIgQzIxOS4wODk4LDU1LjA4MjIgMjA4LjU4ODgsMzguMTQ5MiAxOTMuOTg3OCwyNS4xOTYyIEwxNjIuNzU1OCw1Ni40MjgyIEMxNzUuOTQzOCw2Ny4yMDQyIDE4My40NTY4LDgzLjQzODIgMTgzLjEzNDgsMTAwLjQ2NTIgTDE4My4xMzQ4LDEwNi4wMDkyIEMxOTguNDg1OCwxMDYuMDA5MiAyMTAuOTMxOCwxMTguNDU0MiAyMTAuOTMxOCwxMzMuODA1MiBDMjEwLjkzMTgsMTQ5LjE1NzIgMTk4LjQ4NTgsMTYxLjI5MDIgMTgzLjEzNDgsMTYxLjI5MDIgTDEyNy40NjM4LDE2MS4yOTAyIEwxMjEuOTk3OCwxNjcuMjI0MiBMMTIxLjk5NzgsMjAwLjU2NDIgTDEyNy40NjM4LDIwNS43OTUyIEwxODMuMTM0OCwyMDUuNzk1MiBDMjIzLjA2NDgsMjA2LjEwNjIgMjU1LjY4NjgsMTc0LjMwMTIgMjU1Ljk5NzgsMTM0LjM3MTIgQzI1Ni4xODU4LDExMC4xNjgyIDI0NC4yNTI4LDg3LjQ3ODIgMjI0LjIwNDgsNzMuOTE4MiIgZmlsbD0iIzQyODVGNCI+IDwvcGF0aD4gPHBhdGggZD0iTTcxLjg3MDQsMjA1Ljc5NTcgTDEyNy40NjM0LDIwNS43OTU3IEwxMjcuNDYzNCwxNjEuMjg5NyBMNzEuODcwNCwxNjEuMjg5NyBDNjcuOTA5NCwxNjEuMjg4NyA2NC4wNzM0LDE2MC40Mzc3IDYwLjQ3MTQsMTU4Ljc5MTcgTDUyLjU4NDQsMTYxLjIxMTcgTDMwLjE3NTQsMTgzLjQ2NDcgTDI4LjIyMzQsMTkxLjAzODcgQzQwLjc5MDQsMjAwLjUyNzcgNTYuMTIzNCwyMDUuODYzNyA3MS44NzA0LDIwNS43OTU3IiBmaWxsPSIjMzRBODUzIj4gPC9wYXRoPiA8cGF0aCBkPSJNNzEuODcwNCw2MS40MjU1IEMzMS45Mzk0LDYxLjY2MzUgLTAuMjM2Niw5NC4yMjc1IDAuMDAxNCwxMzQuMTU3NSBDMC4xMzQ0LDE1Ni40NTU1IDEwLjU0ODQsMTc3LjQ0NTUgMjguMjIzNCwxOTEuMDM4NSBMNjAuNDcxNCwxNTguNzkxNSBDNDYuNDgwNCwxNTIuNDcwNSA0MC4yNjM0LDEzNi4wMDU1IDQ2LjU4NDQsMTIyLjAxNTUgQzUyLjkwNDQsMTA4LjAyNTUgNjkuMzcwNCwxMDEuODA4NSA4My4zNTk0LDEwOC4xMjg1IEM4OS41MjQ0LDExMC45MTM1IDk0LjQ2MTQsMTE1Ljg1MTUgOTcuMjQ2NCwxMjIuMDE1NSBMMTI5LjQ5NDQsODkuNzY4NSBDMTE1Ljc3MzQsNzEuODMxNSA5NC40NTM0LDYxLjM0NDUgNzEuODcwNCw2MS40MjU1IiBmaWxsPSIjRkJCQzA1Ij4gPC9wYXRoPiA8L2c+PC9zdmc+Cjx0ZXh0IHg9IjQxNiIgeT0iOTAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTJweCI+U0NDIHNlcnZpY2VzPC90ZXh0Pgo8dGV4dCB4PSI0MTYiIHk9IjEwNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPmRldGVjdG9yIHNldHRpbmdzPC90ZXh0Pgo8dGV4dCB4PSI0MTYiIHk9IjEyMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPnJlcXVpcmVkIGxvZyBpbnB1dHM8L3RleHQ+Cjx0ZXh0IHg9IjQxNiIgeT0iMTM4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+c2VydmljZSB0aWVyPC90ZXh0Pgo8bGluZSB4MT0iNTM2IiB5MT0iMTA5IiB4Mj0iNTkyIiB5Mj0iMTA5IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZ2RzY2MyKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+CjxyZWN0IHg9IjU5NiIgeT0iNjYiIHdpZHRoPSIyMTYiIGhlaWdodD0iODYiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNzA0IiB5PSI5OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMnB4Ij5GaW5kaW5ncyBhbmQgcmVzcG9uc2U8L3RleHQ+Cjx0ZXh0IHg9IjcwNCIgeT0iMTE0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+Y2F0ZWdvcmllcyArIHNldmVyaXR5PC90ZXh0Pgo8dGV4dCB4PSI3MDQiIHk9IjEzMCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPmV4cG9ydCBhbmQgYWxlcnQgcnVsZXM8L3RleHQ+Cjwvc3ZnPg==)

#### Finding names and rules

GuardDuty identifiers such as `UnauthorizedAccess:EC2/SSHBruteForce`, `CryptoCurrency:EC2/BitcoinTool.B` and `Recon:EC2/Portscan` do not become SCC finding identifiers. SCC detectors produce their own categories and severity levels, so update rules that match the AWS identifiers.

Review EventBridge filters, suppression rules and downstream parsers that use GuardDuty finding names, including patterns such as `CryptoCurrency:*`. Determine whether a Google detector covers each required case before rewriting the rule. The diagram describes areas to review, not verified one-to-one finding mappings.

![GuardDuty finding types such as UnauthorizedAccess:EC2/SSHBruteForce have no matching SCC finding names. Review SSH, cryptomining and network-scan detection in SCC separately; there is no one-to-one mapping.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjUwIiB2aWV3Qm94PSIwIDAgODM2IDI1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJHdWFyZER1dHkgZmluZGluZyB0eXBlcyBzdWNoIGFzIFVuYXV0aG9yaXplZEFjY2VzczpFQzIvU1NIQnJ1dGVGb3JjZSBoYXZlIG5vIG1hdGNoaW5nIFNDQyBmaW5kaW5nIG5hbWVzLiBSZXZpZXcgU1NILCBjcnlwdG9taW5pbmcgYW5kIG5ldHdvcmstc2NhbiBkZXRlY3Rpb24gaW4gU0NDIHNlcGFyYXRlbHk7IHRoZXJlIGlzIG5vIG9uZS10by1vbmUgbWFwcGluZy4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0iZ2RzY2MzIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM0ZjQ2ZTUiLz48L21hcmtlcj48L2RlZnM+Cjx0ZXh0IHg9IjI0IiB5PSIyNiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzY0NzQ4YiI+R1VBUkREVVRZIEZJTkRJTkcgVFlQRVMgwrcgQSBGSVhFRCBDQVRBTE9HPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMzYiIHdpZHRoPSIzMzAiIGhlaWdodD0iMzAiIHJ4PSI3IiBzdHJva2Utd2lkdGg9IjEuMiIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIzOCIgeT0iNTYiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmb250LXNpemU6MTBweDtmaWxsOiMzMzQxNTUiPlVuYXV0aG9yaXplZEFjY2VzczpFQzIvU1NIQnJ1dGVGb3JjZTwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjcyIiB3aWR0aD0iMzMwIiBoZWlnaHQ9IjMwIiByeD0iNyIgc3Ryb2tlLXdpZHRoPSIxLjIiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMzgiIHk9IjkyIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZm9udC1zaXplOjEwcHg7ZmlsbDojMzM0MTU1Ij5DcnlwdG9DdXJyZW5jeTpFQzIvQml0Y29pblRvb2wuQjwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjEwOCIgd2lkdGg9IjMzMCIgaGVpZ2h0PSIzMCIgcng9IjciIHN0cm9rZS13aWR0aD0iMS4yIiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjM4IiB5PSIxMjgiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmb250LXNpemU6MTBweDtmaWxsOiMzMzQxNTUiPlJlY29uOkVDMi9Qb3J0c2NhbjwvdGV4dD4KPHRleHQgeD0iMjQiIHk9IjE2OCIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojNjQ3NDhiIj5hIGZpeGVkIHNldCBvZiBBV1Mtc3BlY2lmaWMgZmluZGluZy10eXBlIHN0cmluZ3M8L3RleHQ+CjxsaW5lIHgxPSIzNjYiIHkxPSI5MCIgeDI9IjQyOCIgeTI9IjkwIiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZ2RzY2MzKSIgc3R5bGU9InN0cm9rZTojNGY0NmU1Ii8+Cjx0ZXh0IHg9IjM5NyIgeT0iODIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OHB4Ij5yZXZpZXcgcnVsZXM8L3RleHQ+Cjx0ZXh0IHg9IjM5NyIgeT0iMTA2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjhweCI+Zm9yIFNDQyBjYXRlZ29yaWVzPC90ZXh0Pgo8dGV4dCB4PSI0NDAiIHk9IjI2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojNGY0NmU1Ij5TQ0MgREVURUNUSU9OIFRPIFJFVklFVyBTRVBBUkFURUxZPC90ZXh0Pgo8cmVjdCB4PSI0NDAiIHk9IjM2IiB3aWR0aD0iMzcyIiBoZWlnaHQ9IjMwIiByeD0iNyIgc3Ryb2tlLXdpZHRoPSIxLjIiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNlZWYyZmYiLz4KPHRleHQgeD0iNDU0IiB5PSI1NiIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6IzMzNDE1NSI+UmV2aWV3IFNTSCBkZXRlY3Rpb248L3RleHQ+Cjx0ZXh0IHg9IjgwMCIgeT0iNTYiIHRleHQtYW5jaG9yPSJlbmQiIHN0eWxlPSJmb250OiA2MDAgMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZmlsbDojNGY0NmU1Ij52ZXJpZnk8L3RleHQ+CjxyZWN0IHg9IjQ0MCIgeT0iNzIiIHdpZHRoPSIzNzIiIGhlaWdodD0iMzAiIHJ4PSI3IiBzdHJva2Utd2lkdGg9IjEuMiIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2VlZjJmZiIvPgo8dGV4dCB4PSI0NTQiIHk9IjkyIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjEwcHg7ZmlsbDojMzM0MTU1Ij5SZXZpZXcgY3J5cHRvbWluaW5nIGRldGVjdGlvbjwvdGV4dD4KPHRleHQgeD0iODAwIiB5PSI5MiIgdGV4dC1hbmNob3I9ImVuZCIgc3R5bGU9ImZvbnQ6IDYwMCAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmaWxsOiM0ZjQ2ZTUiPnZlcmlmeTwvdGV4dD4KPHJlY3QgeD0iNDQwIiB5PSIxMDgiIHdpZHRoPSIzNzIiIGhlaWdodD0iMzAiIHJ4PSI3IiBzdHJva2Utd2lkdGg9IjEuMiIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2VlZjJmZiIvPgo8dGV4dCB4PSI0NTQiIHk9IjEyOCIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6IzMzNDE1NSI+UmV2aWV3IG5ldHdvcmstc2NhbiBkZXRlY3Rpb248L3RleHQ+Cjx0ZXh0IHg9IjgwMCIgeT0iMTI4IiB0ZXh0LWFuY2hvcj0iZW5kIiBzdHlsZT0iZm9udDogNjAwIDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZpbGw6IzRmNDZlNSI+dmVyaWZ5PC90ZXh0Pgo8dGV4dCB4PSI0NDAiIHk9IjE2OCIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojNjQ3NDhiIj5leGFtcGxlcyBvZiByZXZpZXcgYXJlYXM7IG5vIG9uZS10by1vbmUgbWFwcGluZzwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjE4OCIgd2lkdGg9Ijc4OCIgaGVpZ2h0PSI0OCIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuMyIgc3R5bGU9ImZpbGw6I2ZmZmJlYjtzdHJva2U6I2ZkZTY4YSIvPgo8dGV4dCB4PSI0MCIgeT0iMjEwIiBzdHlsZT0iZm9udDo3MDAgMTAuNXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojYjQ1MzA5Ij5GSU5ESU5HIE5BTUVTIERJRkZFUjwvdGV4dD4KPHRleHQgeD0iNDAiIHk9IjIyNiIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6IzMzNDE1NSI+VXBkYXRlIHJ1bGVzIHRoYXQgbWF0Y2ggR3VhcmREdXR5IGZpbmRpbmctdHlwZSBzdHJpbmdzIHRvIHVzZSBTQ0MgZmluZGluZyBjYXRlZ29yaWVzLjwvdGV4dD4KPC9zdmc+)

![GuardDuty finding types such as UnauthorizedAccess:EC2/SSHBruteForce have no matching SCC finding names. Review SSH, cryptomining and network-scan detection in SCC separately; there is no one-to-one mapping.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjUwIiB2aWV3Qm94PSIwIDAgODM2IDI1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJHdWFyZER1dHkgZmluZGluZyB0eXBlcyBzdWNoIGFzIFVuYXV0aG9yaXplZEFjY2VzczpFQzIvU1NIQnJ1dGVGb3JjZSBoYXZlIG5vIG1hdGNoaW5nIFNDQyBmaW5kaW5nIG5hbWVzLiBSZXZpZXcgU1NILCBjcnlwdG9taW5pbmcgYW5kIG5ldHdvcmstc2NhbiBkZXRlY3Rpb24gaW4gU0NDIHNlcGFyYXRlbHk7IHRoZXJlIGlzIG5vIG9uZS10by1vbmUgbWFwcGluZy4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0iZ2RzY2MzIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiNhNWI0ZmMiLz48L21hcmtlcj48L2RlZnM+Cjx0ZXh0IHg9IjI0IiB5PSIyNiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6Izk0YTNiOCI+R1VBUkREVVRZIEZJTkRJTkcgVFlQRVMgwrcgQSBGSVhFRCBDQVRBTE9HPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMzYiIHdpZHRoPSIzMzAiIGhlaWdodD0iMzAiIHJ4PSI3IiBzdHJva2Utd2lkdGg9IjEuMiIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIzOCIgeT0iNTYiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmb250LXNpemU6MTBweDtmaWxsOiNjYmQ1ZTEiPlVuYXV0aG9yaXplZEFjY2VzczpFQzIvU1NIQnJ1dGVGb3JjZTwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjcyIiB3aWR0aD0iMzMwIiBoZWlnaHQ9IjMwIiByeD0iNyIgc3Ryb2tlLXdpZHRoPSIxLjIiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMzgiIHk9IjkyIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZm9udC1zaXplOjEwcHg7ZmlsbDojY2JkNWUxIj5DcnlwdG9DdXJyZW5jeTpFQzIvQml0Y29pblRvb2wuQjwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjEwOCIgd2lkdGg9IjMzMCIgaGVpZ2h0PSIzMCIgcng9IjciIHN0cm9rZS13aWR0aD0iMS4yIiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjM4IiB5PSIxMjgiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmb250LXNpemU6MTBweDtmaWxsOiNjYmQ1ZTEiPlJlY29uOkVDMi9Qb3J0c2NhbjwvdGV4dD4KPHRleHQgeD0iMjQiIHk9IjE2OCIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojOTRhM2I4Ij5hIGZpeGVkIHNldCBvZiBBV1Mtc3BlY2lmaWMgZmluZGluZy10eXBlIHN0cmluZ3M8L3RleHQ+CjxsaW5lIHgxPSIzNjYiIHkxPSI5MCIgeDI9IjQyOCIgeTI9IjkwIiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZ2RzY2MzKSIgc3R5bGU9InN0cm9rZTojYTViNGZjIi8+Cjx0ZXh0IHg9IjM5NyIgeT0iODIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OHB4Ij5yZXZpZXcgcnVsZXM8L3RleHQ+Cjx0ZXh0IHg9IjM5NyIgeT0iMTA2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjhweCI+Zm9yIFNDQyBjYXRlZ29yaWVzPC90ZXh0Pgo8dGV4dCB4PSI0NDAiIHk9IjI2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojYTViNGZjIj5TQ0MgREVURUNUSU9OIFRPIFJFVklFVyBTRVBBUkFURUxZPC90ZXh0Pgo8cmVjdCB4PSI0NDAiIHk9IjM2IiB3aWR0aD0iMzcyIiBoZWlnaHQ9IjMwIiByeD0iNyIgc3Ryb2tlLXdpZHRoPSIxLjIiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiMxZTFiNGIiLz4KPHRleHQgeD0iNDU0IiB5PSI1NiIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6I2NiZDVlMSI+UmV2aWV3IFNTSCBkZXRlY3Rpb248L3RleHQ+Cjx0ZXh0IHg9IjgwMCIgeT0iNTYiIHRleHQtYW5jaG9yPSJlbmQiIHN0eWxlPSJmb250OiA2MDAgMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZmlsbDojYTViNGZjIj52ZXJpZnk8L3RleHQ+CjxyZWN0IHg9IjQ0MCIgeT0iNzIiIHdpZHRoPSIzNzIiIGhlaWdodD0iMzAiIHJ4PSI3IiBzdHJva2Utd2lkdGg9IjEuMiIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzFlMWI0YiIvPgo8dGV4dCB4PSI0NTQiIHk9IjkyIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjEwcHg7ZmlsbDojY2JkNWUxIj5SZXZpZXcgY3J5cHRvbWluaW5nIGRldGVjdGlvbjwvdGV4dD4KPHRleHQgeD0iODAwIiB5PSI5MiIgdGV4dC1hbmNob3I9ImVuZCIgc3R5bGU9ImZvbnQ6IDYwMCAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmaWxsOiNhNWI0ZmMiPnZlcmlmeTwvdGV4dD4KPHJlY3QgeD0iNDQwIiB5PSIxMDgiIHdpZHRoPSIzNzIiIGhlaWdodD0iMzAiIHJ4PSI3IiBzdHJva2Utd2lkdGg9IjEuMiIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzFlMWI0YiIvPgo8dGV4dCB4PSI0NTQiIHk9IjEyOCIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6I2NiZDVlMSI+UmV2aWV3IG5ldHdvcmstc2NhbiBkZXRlY3Rpb248L3RleHQ+Cjx0ZXh0IHg9IjgwMCIgeT0iMTI4IiB0ZXh0LWFuY2hvcj0iZW5kIiBzdHlsZT0iZm9udDogNjAwIDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZpbGw6I2E1YjRmYyI+dmVyaWZ5PC90ZXh0Pgo8dGV4dCB4PSI0NDAiIHk9IjE2OCIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojOTRhM2I4Ij5leGFtcGxlcyBvZiByZXZpZXcgYXJlYXM7IG5vIG9uZS10by1vbmUgbWFwcGluZzwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjE4OCIgd2lkdGg9Ijc4OCIgaGVpZ2h0PSI0OCIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuMyIgc3R5bGU9ImZpbGw6IzQyMjAwNjtzdHJva2U6IzkyNDAwZSIvPgo8dGV4dCB4PSI0MCIgeT0iMjEwIiBzdHlsZT0iZm9udDo3MDAgMTAuNXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojZmJiZjI0Ij5GSU5ESU5HIE5BTUVTIERJRkZFUjwvdGV4dD4KPHRleHQgeD0iNDAiIHk9IjIyNiIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6I2NiZDVlMSI+VXBkYXRlIHJ1bGVzIHRoYXQgbWF0Y2ggR3VhcmREdXR5IGZpbmRpbmctdHlwZSBzdHJpbmdzIHRvIHVzZSBTQ0MgZmluZGluZyBjYXRlZ29yaWVzLjwvdGV4dD4KPC9zdmc+)

SCC uses its own finding categories. Rewrite each rule that matches a GuardDuty finding type.

#### Detection sources

Cloud Audit Logs, network logs, DNS logs and GKE signals are candidate inputs for the Google services used in this mapping. Coverage depends on the specific detector and its supported log sources. Review the threats your application must detect instead of assuming that similar log names imply equivalent analysis.

GuardDuty Malware Protection scans EBS volume snapshots. SCC Virtual Machine Threat Detection examines running VM memory. These inspect different data, so assess the required malware scenarios separately; memory inspection does not replace every snapshot-scan use case.

![Each GuardDuty detection source compared with the Google Cloud logs and SCC detector that covers it. VM memory inspection differs from EBS snapshot scanning.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjM0IiB2aWV3Qm94PSIwIDAgODM2IDIzNCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJFYWNoIEd1YXJkRHV0eSBkZXRlY3Rpb24gc291cmNlIGNvbXBhcmVkIHdpdGggdGhlIEdvb2dsZSBDbG91ZCBsb2dzIGFuZCBTQ0MgZGV0ZWN0b3IgdGhhdCBjb3ZlcnMgaXQuIFZNIG1lbW9yeSBpbnNwZWN0aW9uIGRpZmZlcnMgZnJvbSBFQlMgc25hcHNob3Qgc2Nhbm5pbmcuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+Cjx0ZXh0IHg9IjI0IiB5PSIyNCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzMzNDE1NSI+REVURUNUSU9OIFNPVVJDRVMgwrcgR1VBUkREVVRZIOKGkiBHQ1AgVEVMRU1FVFJZIMK3IFNDQyBERVRFQ1RPUjwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjM2IiB3aWR0aD0iNzg4IiBoZWlnaHQ9IjM0IiByeD0iNyIgc3Ryb2tlLXdpZHRoPSIxLjEiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNmOGZhZmMiLz4KPHRleHQgeD0iMzgiIHk9IjU3IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZm9udC1zaXplOjkuNXB4O2ZpbGw6IzY0NzQ4YiI+Q2xvdWRUcmFpbCBtYW5hZ2VtZW50IGV2ZW50czwvdGV4dD4KPHRleHQgeD0iMzMwIiB5PSI1NyIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6IzMzNDE1NSI+Q2xvdWQgQXVkaXQgTG9ncyAoYWRtaW4gYWN0aXZpdHkpPC90ZXh0Pgo8dGV4dCB4PSI4MDAiIHk9IjU3IiB0ZXh0LWFuY2hvcj0iZW5kIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweDtmaWxsOiM0ZjQ2ZTUiPkV2ZW50IFRocmVhdCBEZXRlY3Rpb248L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSI3NCIgd2lkdGg9Ijc4OCIgaGVpZ2h0PSIzNCIgcng9IjciIHN0cm9rZS13aWR0aD0iMS4xIiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojZjhmYWZjIi8+Cjx0ZXh0IHg9IjM4IiB5PSI5NSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZvbnQtc2l6ZTo5LjVweDtmaWxsOiM2NDc0OGIiPlZQQyBGbG93IExvZ3M8L3RleHQ+Cjx0ZXh0IHg9IjMzMCIgeT0iOTUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6MTBweDtmaWxsOiMzMzQxNTUiPk5ldHdvcmsgbG9nczsgdmVyaWZ5IGRldGVjdG9yIHN1cHBvcnQ8L3RleHQ+Cjx0ZXh0IHg9IjgwMCIgeT0iOTUiIHRleHQtYW5jaG9yPSJlbmQiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OXB4O2ZpbGw6IzRmNDZlNSI+RXZlbnQgVGhyZWF0IERldGVjdGlvbjwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjExMiIgd2lkdGg9Ijc4OCIgaGVpZ2h0PSIzNCIgcng9IjciIHN0cm9rZS13aWR0aD0iMS4xIiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojZjhmYWZjIi8+Cjx0ZXh0IHg9IjM4IiB5PSIxMzMiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmb250LXNpemU6OS41cHg7ZmlsbDojNjQ3NDhiIj5ETlMgcXVlcnkgbG9nczwvdGV4dD4KPHRleHQgeD0iMzMwIiB5PSIxMzMiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6MTBweDtmaWxsOiMzMzQxNTUiPkNsb3VkIEROUyBsb2dzPC90ZXh0Pgo8dGV4dCB4PSI4MDAiIHk9IjEzMyIgdGV4dC1hbmNob3I9ImVuZCIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojNGY0NmU1Ij5FdmVudCBUaHJlYXQgRGV0ZWN0aW9uPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMTUwIiB3aWR0aD0iNzg4IiBoZWlnaHQ9IjM0IiByeD0iNyIgc3Ryb2tlLXdpZHRoPSIxLjEiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNmOGZhZmMiLz4KPHRleHQgeD0iMzgiIHk9IjE3MSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZvbnQtc2l6ZTo5LjVweDtmaWxsOiM2NDc0OGIiPkVLUyBhdWRpdCBsb2dzPC90ZXh0Pgo8dGV4dCB4PSIzMzAiIHk9IjE3MSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6IzMzNDE1NSI+R0tFIGF1ZGl0IGxvZ3M8L3RleHQ+Cjx0ZXh0IHg9IjgwMCIgeT0iMTcxIiB0ZXh0LWFuY2hvcj0iZW5kIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweDtmaWxsOiM0ZjQ2ZTUiPkV2ZW50IFRocmVhdCBEZXRlY3Rpb248L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSIxODgiIHdpZHRoPSI3ODgiIGhlaWdodD0iMzQiIHJ4PSI3IiBzdHJva2Utd2lkdGg9IjEuMSIgc3R5bGU9ImZpbGw6I2ZmZmJlYjtzdHJva2U6I2ZkZTY4YSIvPgo8dGV4dCB4PSIzOCIgeT0iMjA5IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZm9udC1zaXplOjkuNXB4O2ZpbGw6IzY0NzQ4YiI+TWFsd2FyZSBQcm90ZWN0aW9uIChFQlMgc25hcHNob3QpPC90ZXh0Pgo8dGV4dCB4PSIzMzAiIHk9IjIwOSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6IzMzNDE1NSI+aW4tbWVtb3J5IFZNIHNjYW48L3RleHQ+Cjx0ZXh0IHg9IjgwMCIgeT0iMjA5IiB0ZXh0LWFuY2hvcj0iZW5kIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweDtmaWxsOiNiNDUzMDkiPlZNIFRocmVhdCBEZXRlY3Rpb24gwrcgZGlmZmVyZW50IG1vZGVsPC90ZXh0Pgo8L3N2Zz4=)

![Each GuardDuty detection source compared with the Google Cloud logs and SCC detector that covers it. VM memory inspection differs from EBS snapshot scanning.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjM0IiB2aWV3Qm94PSIwIDAgODM2IDIzNCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJFYWNoIEd1YXJkRHV0eSBkZXRlY3Rpb24gc291cmNlIGNvbXBhcmVkIHdpdGggdGhlIEdvb2dsZSBDbG91ZCBsb2dzIGFuZCBTQ0MgZGV0ZWN0b3IgdGhhdCBjb3ZlcnMgaXQuIFZNIG1lbW9yeSBpbnNwZWN0aW9uIGRpZmZlcnMgZnJvbSBFQlMgc25hcHNob3Qgc2Nhbm5pbmcuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+Cjx0ZXh0IHg9IjI0IiB5PSIyNCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6I2NiZDVlMSI+REVURUNUSU9OIFNPVVJDRVMgwrcgR1VBUkREVVRZIOKGkiBHQ1AgVEVMRU1FVFJZIMK3IFNDQyBERVRFQ1RPUjwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjM2IiB3aWR0aD0iNzg4IiBoZWlnaHQ9IjM0IiByeD0iNyIgc3Ryb2tlLXdpZHRoPSIxLjEiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiMwZjE3MmEiLz4KPHRleHQgeD0iMzgiIHk9IjU3IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZm9udC1zaXplOjkuNXB4O2ZpbGw6Izk0YTNiOCI+Q2xvdWRUcmFpbCBtYW5hZ2VtZW50IGV2ZW50czwvdGV4dD4KPHRleHQgeD0iMzMwIiB5PSI1NyIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6I2NiZDVlMSI+Q2xvdWQgQXVkaXQgTG9ncyAoYWRtaW4gYWN0aXZpdHkpPC90ZXh0Pgo8dGV4dCB4PSI4MDAiIHk9IjU3IiB0ZXh0LWFuY2hvcj0iZW5kIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweDtmaWxsOiNhNWI0ZmMiPkV2ZW50IFRocmVhdCBEZXRlY3Rpb248L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSI3NCIgd2lkdGg9Ijc4OCIgaGVpZ2h0PSIzNCIgcng9IjciIHN0cm9rZS13aWR0aD0iMS4xIiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojMGYxNzJhIi8+Cjx0ZXh0IHg9IjM4IiB5PSI5NSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZvbnQtc2l6ZTo5LjVweDtmaWxsOiM5NGEzYjgiPlZQQyBGbG93IExvZ3M8L3RleHQ+Cjx0ZXh0IHg9IjMzMCIgeT0iOTUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6MTBweDtmaWxsOiNjYmQ1ZTEiPk5ldHdvcmsgbG9nczsgdmVyaWZ5IGRldGVjdG9yIHN1cHBvcnQ8L3RleHQ+Cjx0ZXh0IHg9IjgwMCIgeT0iOTUiIHRleHQtYW5jaG9yPSJlbmQiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OXB4O2ZpbGw6I2E1YjRmYyI+RXZlbnQgVGhyZWF0IERldGVjdGlvbjwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjExMiIgd2lkdGg9Ijc4OCIgaGVpZ2h0PSIzNCIgcng9IjciIHN0cm9rZS13aWR0aD0iMS4xIiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojMGYxNzJhIi8+Cjx0ZXh0IHg9IjM4IiB5PSIxMzMiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmb250LXNpemU6OS41cHg7ZmlsbDojOTRhM2I4Ij5ETlMgcXVlcnkgbG9nczwvdGV4dD4KPHRleHQgeD0iMzMwIiB5PSIxMzMiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6MTBweDtmaWxsOiNjYmQ1ZTEiPkNsb3VkIEROUyBsb2dzPC90ZXh0Pgo8dGV4dCB4PSI4MDAiIHk9IjEzMyIgdGV4dC1hbmNob3I9ImVuZCIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojYTViNGZjIj5FdmVudCBUaHJlYXQgRGV0ZWN0aW9uPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMTUwIiB3aWR0aD0iNzg4IiBoZWlnaHQ9IjM0IiByeD0iNyIgc3Ryb2tlLXdpZHRoPSIxLjEiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiMwZjE3MmEiLz4KPHRleHQgeD0iMzgiIHk9IjE3MSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZvbnQtc2l6ZTo5LjVweDtmaWxsOiM5NGEzYjgiPkVLUyBhdWRpdCBsb2dzPC90ZXh0Pgo8dGV4dCB4PSIzMzAiIHk9IjE3MSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6I2NiZDVlMSI+R0tFIGF1ZGl0IGxvZ3M8L3RleHQ+Cjx0ZXh0IHg9IjgwMCIgeT0iMTcxIiB0ZXh0LWFuY2hvcj0iZW5kIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweDtmaWxsOiNhNWI0ZmMiPkV2ZW50IFRocmVhdCBEZXRlY3Rpb248L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSIxODgiIHdpZHRoPSI3ODgiIGhlaWdodD0iMzQiIHJ4PSI3IiBzdHJva2Utd2lkdGg9IjEuMSIgc3R5bGU9ImZpbGw6IzQyMjAwNjtzdHJva2U6IzkyNDAwZSIvPgo8dGV4dCB4PSIzOCIgeT0iMjA5IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZm9udC1zaXplOjkuNXB4O2ZpbGw6Izk0YTNiOCI+TWFsd2FyZSBQcm90ZWN0aW9uIChFQlMgc25hcHNob3QpPC90ZXh0Pgo8dGV4dCB4PSIzMzAiIHk9IjIwOSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6I2NiZDVlMSI+aW4tbWVtb3J5IFZNIHNjYW48L3RleHQ+Cjx0ZXh0IHg9IjgwMCIgeT0iMjA5IiB0ZXh0LWFuY2hvcj0iZW5kIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweDtmaWxsOiNmYmJmMjQiPlZNIFRocmVhdCBEZXRlY3Rpb24gwrcgZGlmZmVyZW50IG1vZGVsPC90ZXh0Pgo8L3N2Zz4=)

Review each Google detector and its log inputs against the required threat scenarios.

#### Detectors and access

Event Threat Detection analyzes supported log sources. Container Threat Detection and Virtual Machine Threat Detection examine different workload signals. Choose the services for the workloads you actually run and confirm they are available in your SCC subscription.

Control who can read findings and exports, as well as who can reach the protected resources. Your security operators need SCC's categories, severity levels and resource identifiers in their response procedures.

#### Limitations

Where Security Command Center and GuardDuty differ

* **Event Threat Detection is not turned on for you.** Tensor9 creates the SCC source only. You turn on the detectors in SCC's settings, at the Premium or Enterprise tier, and confirm each one is available.
* **Finding names behave differently: rules that match GuardDuty names stop matching.** Rules matching `UnauthorizedAccess:EC2/SSHBruteForce` or `CryptoCurrency:*` need a detector-by-detector coverage review and new rules for SCC.
* **GuardDuty filters, IP sets, threat feeds and publishing destinations are not recreated.** The build reports each `aws_guardduty_filter`, `aws_guardduty_ipset`, `aws_guardduty_threatintelset` and `aws_guardduty_publishing_destination` it does not transfer. Configure the matching SCC controls, such as mute rules, for each requirement.
* **You must turn on detection for S3 data events, EKS audit logs and malware scanning.** If your detector uses these sources, the build reports a warning for each one. Turn on and check the matching SCC service.
* **Malware scanning behaves differently.** GuardDuty scans EBS snapshots; SCC Virtual Machine Threat Detection inspects VM memory. They examine different data, so choose protection by workload and threat.

#### Other considerations

* **Organization scope.** The source is created in your Google Cloud organization. Historical GuardDuty findings are not copied.
* **Export and response rules.** Configure Pub/Sub export, Google SecOps rules and response automation for the detectors you turn on. Review GuardDuty EventBridge rules against SCC categories and severity.
* **Service tier and detector settings.** SCC service availability and pricing depend on your subscription. Confirm each detector and log input you need.
* **Outputs keep working.** Terraform outputs that read the detector's `id`, `arn` or `account_id` still resolve; they return the detector's name.

## On OCI

### OCI Cloud Guard

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| Account activity threat detection (CloudTrail analysis) | Detection sources | Supported | Common | Cloud Guard activity detectors analyze OCI Audit events. Their rules differ from GuardDuty's CloudTrail finding types. |
| Configuration / posture detection | Detection sources | Supported | Most usage | Cloud Guard configuration detectors identify resource configuration issues in addition to activity-based threats. |
| Kubernetes audit-log threat detection (EKS) | Detection sources | Partial | Most usage | OKE coverage depends on Cloud Guard's available detector recipes. It does not reproduce GuardDuty's EKS audit-log finding catalog. |
| Network threat detection (VPC Flow Log analysis) | Detection sources | Partial | Full surface | Cloud Guard's activity and configuration detection differs from GuardDuty's network-flow analysis. Review the specific network threats your workload requires. |
| Threat-intel detection | Detection sources | Supported | Most usage | Cloud Guard threat detectors use OCI's threat signals and rules; findings do not match GuardDuty's catalog one-for-one. |
| Detector enablement (Cloud Guard recipes + target) | Detector | Supported | Common | Maps to Cloud Guard with a compartment target and the required detector recipes. Recipes determine which resources and activity are monitored. |
| GuardDuty finding-type catalog | Findings | Out of scope | Full surface | GuardDuty finding-type strings do not map one-for-one to Cloud Guard problem types. Update automations that match AWS finding names. |
| Response / auto-remediation | Findings | Supported | Common | Cloud Guard responder recipes can act on detected problems. Responses are opt-in and can change live resources; review them before enabling. |
| Severity-scored findings | Findings | Supported | Common | Cloud Guard produces severity-scored problems using its own problem types and scoring. |
| Finding filters (aws\_guardduty\_filter) | Suppression + lists | Out of scope | Full surface | GuardDuty filters do not translate directly. Review and recreate required suppression in Cloud Guard detector-rule conditions. |
| Threat-intel sets (aws\_guardduty\_threatintelset) | Suppression + lists | Out of scope | Full surface | GuardDuty threat-intelligence feeds require backend-specific configuration; they are not copied directly. |
| Trusted IP sets (aws\_guardduty\_ipset) | Suppression + lists | Out of scope | Full surface | GuardDuty trusted-IP lists require Cloud Guard managed-list or detector-rule configuration; they are not copied directly. |

#### How it works

On OCI, GuardDuty maps to Cloud Guard. Detector recipes, sets of rules that analyze OCI resources, raise problems with severity levels. Oracle operates the service. This is a best-effort match: OCI's rules and signals do not reproduce GuardDuty's finding catalog.

When Tensor9 builds the deployment, it enables Cloud Guard and creates a target for the deployment's compartment. You attach the detector recipes for the threats you need, and configure OCI Events or responder recipes for follow-up actions. Review network and container detection separately: Cloud Guard's extra configuration checks do not fill gaps there.

![On AWS, GuardDuty analyzes AWS telemetry and reports severity-scored findings. On OCI, Tensor9 enables Cloud Guard with a target for the deployment's compartment; detector recipes you attach analyze OCI activity and configuration and raise problems.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjEwIiB2aWV3Qm94PSIwIDAgODM2IDIxMCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MsIEd1YXJkRHV0eSBhbmFseXplcyBBV1MgdGVsZW1ldHJ5IGFuZCByZXBvcnRzIHNldmVyaXR5LXNjb3JlZCBmaW5kaW5ncy4gT24gT0NJLCBUZW5zb3I5IGVuYWJsZXMgQ2xvdWQgR3VhcmQgd2l0aCBhIHRhcmdldCBmb3IgdGhlIGRlcGxveW1lbnQncyBjb21wYXJ0bWVudDsgZGV0ZWN0b3IgcmVjaXBlcyB5b3UgYXR0YWNoIGFuYWx5emUgT0NJIGFjdGl2aXR5IGFuZCBjb25maWd1cmF0aW9uIGFuZCByYWlzZSBwcm9ibGVtcy4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0iZ2RjZzEiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6Izk0YTNiOCIvPjwvbWFya2VyPjxtYXJrZXIgaWQ9ImdkY2cxYiIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojZGMyNjI2Ii8+PC9tYXJrZXI+PC9kZWZzPgo8cmVjdCB4PSIxNiIgeT0iNDAiIHdpZHRoPSIzODQiIGhlaWdodD0iMTUyIiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMzAiIHk9IjYwIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojNjQ3NDhiIj5PTiBBV1MgVE9EQVk8L3RleHQ+CjxyZWN0IHg9IjI4IiB5PSI3NiIgd2lkdGg9IjEyMCIgaGVpZ2h0PSI5NiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI4OCIgeT0iMTEyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjExcHgiPkFXUyB0ZWxlbWV0cnk8L3RleHQ+Cjx0ZXh0IHg9Ijg4IiB5PSIxMzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OXB4Ij5DbG91ZFRyYWlsIMK3IFZQQyBGbG93PC90ZXh0Pgo8dGV4dCB4PSI4OCIgeT0iMTQ0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweCI+RE5TIMK3IEVLUyDCtyBTMzwvdGV4dD4KPGxpbmUgeDE9IjE0OCIgeTE9IjEyNCIgeDI9IjE3MCIgeTI9IjEyNCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2dkY2cxKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+CjxyZWN0IHg9IjE3MiIgeT0iOTQiIHdpZHRoPSIxMTIiIGhlaWdodD0iNjAiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMjI4IiB5PSIxMjAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTEuNXB4Ij5HdWFyZER1dHk8L3RleHQ+Cjx0ZXh0IHg9IjIyOCIgeT0iMTM2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjkuNXB4Ij5vbmUgZGV0ZWN0b3I8L3RleHQ+CjxsaW5lIHgxPSIyODQiIHkxPSIxMjQiIHgyPSIzMDYiIHkyPSIxMjQiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNnZGNnMSkiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSIzMDgiIHk9Ijk0IiB3aWR0aD0iODQiIGhlaWdodD0iNjAiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMzUwIiB5PSIxMjAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTAuNXB4Ij5GaW5kaW5nczwvdGV4dD4KPHRleHQgeD0iMzUwIiB5PSIxMzYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OXB4Ij5zZXZlcml0eS1zY29yZWQ8L3RleHQ+CjxsaW5lIHgxPSI0MTgiIHkxPSI0NiIgeDI9IjQxOCIgeTI9IjE4NiIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJzdHJva2U6I2NiZDVlMSIvPgo8cmVjdCB4PSI0MzYiIHk9IjQwIiB3aWR0aD0iMzg0IiBoZWlnaHQ9IjE1MiIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjQ1MCIgeT0iNjAiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiMwNDc4NTciPk9OIE9DSTwvdGV4dD4KPHJlY3QgeD0iNDQ4IiB5PSI3NiIgd2lkdGg9IjExNiIgaGVpZ2h0PSI5NiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI1MDYiIHk9IjExMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMC41cHgiPk9DSSB0ZWxlbWV0cnk8L3RleHQ+Cjx0ZXh0IHg9IjUwNiIgeT0iMTMwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweCI+QXVkaXQgwrcgY29uZmlnPC90ZXh0Pgo8dGV4dCB4PSI1MDYiIHk9IjE0NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5cHgiPnRocmVhdCBmZWVkczwvdGV4dD4KPGxpbmUgeDE9IjU2NCIgeTE9IjEyNCIgeDI9IjU4NiIgeTI9IjEyNCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2dkY2cxYikiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSI1ODgiIHk9IjkwIiB3aWR0aD0iMTQwIiBoZWlnaHQ9IjY4IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS42IiBzdHlsZT0iZmlsbDojZmVmMmYyO3N0cm9rZTojZGMyNjI2Ii8+Cjx0ZXh0IHg9IjY1OCIgeT0iMTE0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjExcHg7ZmlsbDojZGMyNjI2Ij5DbG91ZCBHdWFyZDwvdGV4dD4KPHRleHQgeD0iNjU4IiB5PSIxMzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OXB4Ij5kZXRlY3RvciByZWNpcGVzPC90ZXh0Pgo8dGV4dCB4PSI2NTgiIHk9IjE0NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDYwMCAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3Ij5hdHRhY2ggc2VwYXJhdGVseTwvdGV4dD4KPGxpbmUgeDE9IjcyOCIgeTE9IjEyNCIgeDI9Ijc0OCIgeTI9IjEyNCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2dkY2cxYikiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSI3NTAiIHk9Ijk0IiB3aWR0aD0iNjYiIGhlaWdodD0iNjAiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNzgzIiB5PSIxMTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6OS41cHgiPlByb2JsZW1zPC90ZXh0Pgo8dGV4dCB4PSI3ODMiIHk9IjEzMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo4LjVweCI+Y29uZmlndXJlPHRzcGFuIHg9Ijc4MyIgZHk9IjExIj5yZXNwb25zZTwvdHNwYW4+PC90ZXh0Pgo8dGV4dCB4PSI2MjgiIHk9IjE4MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojMDQ3ODU3Ij5UZW5zb3I5IGVuYWJsZXMgQ2xvdWQgR3VhcmQgYW5kIGEgdGFyZ2V0OyB5b3UgYXR0YWNoIHJlY2lwZXM8L3RleHQ+Cjwvc3ZnPg==)

![On AWS, GuardDuty analyzes AWS telemetry and reports severity-scored findings. On OCI, Tensor9 enables Cloud Guard with a target for the deployment's compartment; detector recipes you attach analyze OCI activity and configuration and raise problems.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjEwIiB2aWV3Qm94PSIwIDAgODM2IDIxMCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPbiBBV1MsIEd1YXJkRHV0eSBhbmFseXplcyBBV1MgdGVsZW1ldHJ5IGFuZCByZXBvcnRzIHNldmVyaXR5LXNjb3JlZCBmaW5kaW5ncy4gT24gT0NJLCBUZW5zb3I5IGVuYWJsZXMgQ2xvdWQgR3VhcmQgd2l0aCBhIHRhcmdldCBmb3IgdGhlIGRlcGxveW1lbnQncyBjb21wYXJ0bWVudDsgZGV0ZWN0b3IgcmVjaXBlcyB5b3UgYXR0YWNoIGFuYWx5emUgT0NJIGFjdGl2aXR5IGFuZCBjb25maWd1cmF0aW9uIGFuZCByYWlzZSBwcm9ibGVtcy4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0iZ2RjZzEiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzY0NzQ4YiIvPjwvbWFya2VyPjxtYXJrZXIgaWQ9ImdkY2cxYiIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojZjg3MTcxIi8+PC9tYXJrZXI+PC9kZWZzPgo8cmVjdCB4PSIxNiIgeT0iNDAiIHdpZHRoPSIzODQiIGhlaWdodD0iMTUyIiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMzAiIHk9IjYwIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojOTRhM2I4Ij5PTiBBV1MgVE9EQVk8L3RleHQ+CjxyZWN0IHg9IjI4IiB5PSI3NiIgd2lkdGg9IjEyMCIgaGVpZ2h0PSI5NiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI4OCIgeT0iMTEyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjExcHgiPkFXUyB0ZWxlbWV0cnk8L3RleHQ+Cjx0ZXh0IHg9Ijg4IiB5PSIxMzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OXB4Ij5DbG91ZFRyYWlsIMK3IFZQQyBGbG93PC90ZXh0Pgo8dGV4dCB4PSI4OCIgeT0iMTQ0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweCI+RE5TIMK3IEVLUyDCtyBTMzwvdGV4dD4KPGxpbmUgeDE9IjE0OCIgeTE9IjEyNCIgeDI9IjE3MCIgeTI9IjEyNCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2dkY2cxKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+CjxyZWN0IHg9IjE3MiIgeT0iOTQiIHdpZHRoPSIxMTIiIGhlaWdodD0iNjAiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMjI4IiB5PSIxMjAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTEuNXB4Ij5HdWFyZER1dHk8L3RleHQ+Cjx0ZXh0IHg9IjIyOCIgeT0iMTM2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjkuNXB4Ij5vbmUgZGV0ZWN0b3I8L3RleHQ+CjxsaW5lIHgxPSIyODQiIHkxPSIxMjQiIHgyPSIzMDYiIHkyPSIxMjQiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNnZGNnMSkiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSIzMDgiIHk9Ijk0IiB3aWR0aD0iODQiIGhlaWdodD0iNjAiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMzUwIiB5PSIxMjAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTAuNXB4Ij5GaW5kaW5nczwvdGV4dD4KPHRleHQgeD0iMzUwIiB5PSIxMzYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OXB4Ij5zZXZlcml0eS1zY29yZWQ8L3RleHQ+CjxsaW5lIHgxPSI0MTgiIHkxPSI0NiIgeDI9IjQxOCIgeTI9IjE4NiIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJzdHJva2U6IzQ3NTU2OSIvPgo8cmVjdCB4PSI0MzYiIHk9IjQwIiB3aWR0aD0iMzg0IiBoZWlnaHQ9IjE1MiIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjQ1MCIgeT0iNjAiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiM2ZWU3YjciPk9OIE9DSTwvdGV4dD4KPHJlY3QgeD0iNDQ4IiB5PSI3NiIgd2lkdGg9IjExNiIgaGVpZ2h0PSI5NiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI1MDYiIHk9IjExMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMC41cHgiPk9DSSB0ZWxlbWV0cnk8L3RleHQ+Cjx0ZXh0IHg9IjUwNiIgeT0iMTMwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweCI+QXVkaXQgwrcgY29uZmlnPC90ZXh0Pgo8dGV4dCB4PSI1MDYiIHk9IjE0NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5cHgiPnRocmVhdCBmZWVkczwvdGV4dD4KPGxpbmUgeDE9IjU2NCIgeTE9IjEyNCIgeDI9IjU4NiIgeTI9IjEyNCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2dkY2cxYikiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSI1ODgiIHk9IjkwIiB3aWR0aD0iMTQwIiBoZWlnaHQ9IjY4IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS42IiBzdHlsZT0iZmlsbDojNDUwYTBhO3N0cm9rZTojZjg3MTcxIi8+Cjx0ZXh0IHg9IjY1OCIgeT0iMTE0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjExcHg7ZmlsbDojZjg3MTcxIj5DbG91ZCBHdWFyZDwvdGV4dD4KPHRleHQgeD0iNjU4IiB5PSIxMzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OXB4Ij5kZXRlY3RvciByZWNpcGVzPC90ZXh0Pgo8dGV4dCB4PSI2NTgiIHk9IjE0NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDYwMCAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3Ij5hdHRhY2ggc2VwYXJhdGVseTwvdGV4dD4KPGxpbmUgeDE9IjcyOCIgeTE9IjEyNCIgeDI9Ijc0OCIgeTI9IjEyNCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2dkY2cxYikiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSI3NTAiIHk9Ijk0IiB3aWR0aD0iNjYiIGhlaWdodD0iNjAiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNzgzIiB5PSIxMTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6OS41cHgiPlByb2JsZW1zPC90ZXh0Pgo8dGV4dCB4PSI3ODMiIHk9IjEzMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo4LjVweCI+Y29uZmlndXJlPHRzcGFuIHg9Ijc4MyIgZHk9IjExIj5yZXNwb25zZTwvdHNwYW4+PC90ZXh0Pgo8dGV4dCB4PSI2MjgiIHk9IjE4MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojNmVlN2I3Ij5UZW5zb3I5IGVuYWJsZXMgQ2xvdWQgR3VhcmQgYW5kIGEgdGFyZ2V0OyB5b3UgYXR0YWNoIHJlY2lwZXM8L3RleHQ+Cjwvc3ZnPg==)

Tensor9 enables Cloud Guard and creates a compartment target; detector recipes decide what is detected.

#### What Tensor9 turns on

Tensor9 creates an `oci_cloud_guard_cloud_guard_configuration` with `status = "ENABLED"` and an `oci_cloud_guard_target` for the deployment's compartment. The reporting region is the deployment's OCI region; if none is set, it defaults to `us-ashburn-1` and the build reports a warning. Detector recipes attached to the target decide which rules run.

Choose and check Activity, Configuration and Threat recipes against your requirements. Responder recipes are separate controls that can change resources.

![Your GuardDuty detector becomes the Cloud Guard tenancy setting, enabled with a reporting region, and a Cloud Guard target for the deployment's compartment. You attach detector recipes and configure responses separately.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjMyIiB2aWV3Qm94PSIwIDAgODM2IDIzMiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJZb3VyIEd1YXJkRHV0eSBkZXRlY3RvciBiZWNvbWVzIHRoZSBDbG91ZCBHdWFyZCB0ZW5hbmN5IHNldHRpbmcsIGVuYWJsZWQgd2l0aCBhIHJlcG9ydGluZyByZWdpb24sIGFuZCBhIENsb3VkIEd1YXJkIHRhcmdldCBmb3IgdGhlIGRlcGxveW1lbnQncyBjb21wYXJ0bWVudC4gWW91IGF0dGFjaCBkZXRlY3RvciByZWNpcGVzIGFuZCBjb25maWd1cmUgcmVzcG9uc2VzIHNlcGFyYXRlbHkuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImdkY2cyIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM5NGEzYjgiLz48L21hcmtlcj48L2RlZnM+Cjx0ZXh0IHg9IjI0IiB5PSIyNiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzY0NzQ4YiI+WU9VUiBHVUFSRERVVFkgREVURUNUT1I8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSI0MCIgd2lkdGg9IjE4OCIgaGVpZ2h0PSI3MiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIxMTgiIHk9IjcwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZm9udC1zaXplOjEwcHg7ZmlsbDojMzM0MTU1Ij5hd3NfZ3VhcmRkdXR5X2RldGVjdG9yPC90ZXh0Pgo8dGV4dCB4PSIxMTgiIHk9IjkwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjkuNXB4Ij5vbmUgZGV0ZWN0b3IsIGZlYXR1cmUgdG9nZ2xlczwvdGV4dD4KPGxpbmUgeDE9IjIxMiIgeTE9Ijc2IiB4Mj0iMjU2IiB5Mj0iNzYiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNnZGNnMikiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8dGV4dCB4PSIyMzQiIHk9IjY4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjhweCI+YmVjb21lczwvdGV4dD4KPHJlY3QgeD0iMjY0IiB5PSIyNCIgd2lkdGg9IjU0OCIgaGVpZ2h0PSIxODgiIHJ4PSIxMyIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiNmZWYyZjI7c3Ryb2tlOiNkYzI2MjYiLz4KPHRleHQgeD0iMjg0IiB5PSI0NiIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMS41cHg7ZmlsbDojZGMyNjI2Ij5PQ0kgQ2xvdWQgR3VhcmQgwrcgdGVuYW5jeSBlbmFibGVtZW50ICsgdGFyZ2V0PC90ZXh0Pgo8cmVjdCB4PSIyODAiIHk9IjU4IiB3aWR0aD0iNTE2IiBoZWlnaHQ9IjQyIiByeD0iOCIgc3Ryb2tlLXdpZHRoPSIxLjIiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNmZWNhY2EiLz4KPHRleHQgeD0iMjk0IiB5PSI3NiIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo4LjVweDtmaWxsOiNkYzI2MjYiPm9jaV9jbG91ZF9ndWFyZF9jbG91ZF9ndWFyZF9jb25maWd1cmF0aW9uPC90ZXh0Pgo8dGV4dCB4PSIyOTQiIHk9IjkyIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZm9udC1zaXplOjEwcHg7ZmlsbDojMzM0MTU1Ij5zdGF0dXMgPSAiRU5BQkxFRCIgICByZXBvcnRpbmdfcmVnaW9uID0gdGhlIGRlcGxveW1lbnQncyByZWdpb248L3RleHQ+Cjx0ZXh0IHg9Ijc4MiIgeT0iODQiIHRleHQtYW5jaG9yPSJlbmQiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OC41cHgiPnRoZSB0ZW5hbmN5IHN3aXRjaDwvdGV4dD4KPHJlY3QgeD0iMjgwIiB5PSIxMDYiIHdpZHRoPSI1MTYiIGhlaWdodD0iNDIiIHJ4PSI4IiBzdHJva2Utd2lkdGg9IjEuMiIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2ZlY2FjYSIvPgo8dGV4dCB4PSIyOTQiIHk9IjEyNCIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo4LjVweDtmaWxsOiNkYzI2MjYiPm9jaV9jbG91ZF9ndWFyZF90YXJnZXQgwrcgdGFyZ2V0X3Jlc291cmNlX3R5cGUgPSBDT01QQVJUTUVOVDwvdGV4dD4KPHRleHQgeD0iMjk0IiB5PSIxNDAiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmb250LXNpemU6MTBweDtmaWxsOiMzMzQxNTUiPmNvbXBhcnRtZW50X2lkID0gdGhlIGRlcGxveW1lbnQncyBjb21wYXJ0bWVudDwvdGV4dD4KPHRleHQgeD0iNzgyIiB5PSIxMzIiIHRleHQtYW5jaG9yPSJlbmQiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OC41cHgiPnRoZSBkZXRlY3Rpb24gc2NvcGU8L3RleHQ+CjxyZWN0IHg9IjI4MCIgeT0iMTU0IiB3aWR0aD0iNTE2IiBoZWlnaHQ9IjQ0IiByeD0iOCIgc3Ryb2tlLXdpZHRoPSIxIiBzdHlsZT0iZmlsbDojZmVmMmYyO3N0cm9rZTojZmVjYWNhIi8+Cjx0ZXh0IHg9IjI5NCIgeT0iMTc0IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjkuNXB4O2ZpbGw6IzMzNDE1NSI+ZW5hYmxlZCBhdCB0aGUgdGVuYW5jeSDCtyBPcmFjbGUgb3BlcmF0ZXMgdGhlIGRldGVjdGlvbiBlbmdpbmU8L3RleHQ+Cjx0ZXh0IHg9IjI5NCIgeT0iMTkwIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweDtmaWxsOiM2NDc0OGIiPmF0dGFjaCBhbmQgcmV2aWV3IGRldGVjdG9yIHJlY2lwZXM7IGNvbmZpZ3VyZSByZXNwb25zZSBhY3Rpb25zIHNlcGFyYXRlbHk8L3RleHQ+Cjwvc3ZnPg==)

![Your GuardDuty detector becomes the Cloud Guard tenancy setting, enabled with a reporting region, and a Cloud Guard target for the deployment's compartment. You attach detector recipes and configure responses separately.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjMyIiB2aWV3Qm94PSIwIDAgODM2IDIzMiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJZb3VyIEd1YXJkRHV0eSBkZXRlY3RvciBiZWNvbWVzIHRoZSBDbG91ZCBHdWFyZCB0ZW5hbmN5IHNldHRpbmcsIGVuYWJsZWQgd2l0aCBhIHJlcG9ydGluZyByZWdpb24sIGFuZCBhIENsb3VkIEd1YXJkIHRhcmdldCBmb3IgdGhlIGRlcGxveW1lbnQncyBjb21wYXJ0bWVudC4gWW91IGF0dGFjaCBkZXRlY3RvciByZWNpcGVzIGFuZCBjb25maWd1cmUgcmVzcG9uc2VzIHNlcGFyYXRlbHkuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImdkY2cyIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM2NDc0OGIiLz48L21hcmtlcj48L2RlZnM+Cjx0ZXh0IHg9IjI0IiB5PSIyNiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6Izk0YTNiOCI+WU9VUiBHVUFSRERVVFkgREVURUNUT1I8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSI0MCIgd2lkdGg9IjE4OCIgaGVpZ2h0PSI3MiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIxMTgiIHk9IjcwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZm9udC1zaXplOjEwcHg7ZmlsbDojY2JkNWUxIj5hd3NfZ3VhcmRkdXR5X2RldGVjdG9yPC90ZXh0Pgo8dGV4dCB4PSIxMTgiIHk9IjkwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjkuNXB4Ij5vbmUgZGV0ZWN0b3IsIGZlYXR1cmUgdG9nZ2xlczwvdGV4dD4KPGxpbmUgeDE9IjIxMiIgeTE9Ijc2IiB4Mj0iMjU2IiB5Mj0iNzYiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNnZGNnMikiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8dGV4dCB4PSIyMzQiIHk9IjY4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjhweCI+YmVjb21lczwvdGV4dD4KPHJlY3QgeD0iMjY0IiB5PSIyNCIgd2lkdGg9IjU0OCIgaGVpZ2h0PSIxODgiIHJ4PSIxMyIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiM0NTBhMGE7c3Ryb2tlOiNmODcxNzEiLz4KPHRleHQgeD0iMjg0IiB5PSI0NiIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMS41cHg7ZmlsbDojZjg3MTcxIj5PQ0kgQ2xvdWQgR3VhcmQgwrcgdGVuYW5jeSBlbmFibGVtZW50ICsgdGFyZ2V0PC90ZXh0Pgo8cmVjdCB4PSIyODAiIHk9IjU4IiB3aWR0aD0iNTE2IiBoZWlnaHQ9IjQyIiByeD0iOCIgc3Ryb2tlLXdpZHRoPSIxLjIiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM3ZjFkMWQiLz4KPHRleHQgeD0iMjk0IiB5PSI3NiIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo4LjVweDtmaWxsOiNmODcxNzEiPm9jaV9jbG91ZF9ndWFyZF9jbG91ZF9ndWFyZF9jb25maWd1cmF0aW9uPC90ZXh0Pgo8dGV4dCB4PSIyOTQiIHk9IjkyIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZm9udC1zaXplOjEwcHg7ZmlsbDojY2JkNWUxIj5zdGF0dXMgPSAiRU5BQkxFRCIgICByZXBvcnRpbmdfcmVnaW9uID0gdGhlIGRlcGxveW1lbnQncyByZWdpb248L3RleHQ+Cjx0ZXh0IHg9Ijc4MiIgeT0iODQiIHRleHQtYW5jaG9yPSJlbmQiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OC41cHgiPnRoZSB0ZW5hbmN5IHN3aXRjaDwvdGV4dD4KPHJlY3QgeD0iMjgwIiB5PSIxMDYiIHdpZHRoPSI1MTYiIGhlaWdodD0iNDIiIHJ4PSI4IiBzdHJva2Utd2lkdGg9IjEuMiIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzdmMWQxZCIvPgo8dGV4dCB4PSIyOTQiIHk9IjEyNCIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo4LjVweDtmaWxsOiNmODcxNzEiPm9jaV9jbG91ZF9ndWFyZF90YXJnZXQgwrcgdGFyZ2V0X3Jlc291cmNlX3R5cGUgPSBDT01QQVJUTUVOVDwvdGV4dD4KPHRleHQgeD0iMjk0IiB5PSIxNDAiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmb250LXNpemU6MTBweDtmaWxsOiNjYmQ1ZTEiPmNvbXBhcnRtZW50X2lkID0gdGhlIGRlcGxveW1lbnQncyBjb21wYXJ0bWVudDwvdGV4dD4KPHRleHQgeD0iNzgyIiB5PSIxMzIiIHRleHQtYW5jaG9yPSJlbmQiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OC41cHgiPnRoZSBkZXRlY3Rpb24gc2NvcGU8L3RleHQ+CjxyZWN0IHg9IjI4MCIgeT0iMTU0IiB3aWR0aD0iNTE2IiBoZWlnaHQ9IjQ0IiByeD0iOCIgc3Ryb2tlLXdpZHRoPSIxIiBzdHlsZT0iZmlsbDojNDUwYTBhO3N0cm9rZTojN2YxZDFkIi8+Cjx0ZXh0IHg9IjI5NCIgeT0iMTc0IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjkuNXB4O2ZpbGw6I2NiZDVlMSI+ZW5hYmxlZCBhdCB0aGUgdGVuYW5jeSDCtyBPcmFjbGUgb3BlcmF0ZXMgdGhlIGRldGVjdGlvbiBlbmdpbmU8L3RleHQ+Cjx0ZXh0IHg9IjI5NCIgeT0iMTkwIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweDtmaWxsOiM5NGEzYjgiPmF0dGFjaCBhbmQgcmV2aWV3IGRldGVjdG9yIHJlY2lwZXM7IGNvbmZpZ3VyZSByZXNwb25zZSBhY3Rpb25zIHNlcGFyYXRlbHk8L3RleHQ+Cjwvc3ZnPg==)

The detector becomes Cloud Guard's tenancy setting and a target for the deployment's compartment.

#### Finding names and rules

GuardDuty identifiers such as `UnauthorizedAccess:EC2/SSHBruteForce`, `CryptoCurrency:EC2/BitcoinTool.B` and `Recon:EC2/Portscan` are AWS-specific. Cloud Guard reports problems for suspicious activity, public exposure and risky configuration using its own names and severity assignments.

Review EventBridge filters, suppression rules and downstream parsers that use GuardDuty finding names, including patterns such as `CryptoCurrency:*`. Rewrite them for the relevant Cloud Guard problem types and detector rules. Enabling Cloud Guard does not translate this automation, and Cloud Guard does not detect exactly the same set of threats.

![GuardDuty finding types such as UnauthorizedAccess:EC2/SSHBruteForce have no matching Cloud Guard problem names. Cloud Guard reports its own problems, such as suspicious activity on an instance; check each rule and severity.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjUwIiB2aWV3Qm94PSIwIDAgODM2IDI1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJHdWFyZER1dHkgZmluZGluZyB0eXBlcyBzdWNoIGFzIFVuYXV0aG9yaXplZEFjY2VzczpFQzIvU1NIQnJ1dGVGb3JjZSBoYXZlIG5vIG1hdGNoaW5nIENsb3VkIEd1YXJkIHByb2JsZW0gbmFtZXMuIENsb3VkIEd1YXJkIHJlcG9ydHMgaXRzIG93biBwcm9ibGVtcywgc3VjaCBhcyBzdXNwaWNpb3VzIGFjdGl2aXR5IG9uIGFuIGluc3RhbmNlOyBjaGVjayBlYWNoIHJ1bGUgYW5kIHNldmVyaXR5LiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJnZGNnMyIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojZGMyNjI2Ii8+PC9tYXJrZXI+PC9kZWZzPgo8dGV4dCB4PSIyNCIgeT0iMjYiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiM2NDc0OGIiPkdVQVJERFVUWSBGSU5ESU5HIFRZUEVTIMK3IEEgRklYRUQgQ0FUQUxPRzwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjM2IiB3aWR0aD0iMzMwIiBoZWlnaHQ9IjMwIiByeD0iNyIgc3Ryb2tlLXdpZHRoPSIxLjIiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMzgiIHk9IjU2IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZm9udC1zaXplOjEwcHg7ZmlsbDojMzM0MTU1Ij5VbmF1dGhvcml6ZWRBY2Nlc3M6RUMyL1NTSEJydXRlRm9yY2U8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSI3MiIgd2lkdGg9IjMzMCIgaGVpZ2h0PSIzMCIgcng9IjciIHN0cm9rZS13aWR0aD0iMS4yIiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjM4IiB5PSI5MiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6IzMzNDE1NSI+Q3J5cHRvQ3VycmVuY3k6RUMyL0JpdGNvaW5Ub29sLkI8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSIxMDgiIHdpZHRoPSIzMzAiIGhlaWdodD0iMzAiIHJ4PSI3IiBzdHJva2Utd2lkdGg9IjEuMiIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIzOCIgeT0iMTI4IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZm9udC1zaXplOjEwcHg7ZmlsbDojMzM0MTU1Ij5SZWNvbjpFQzIvUG9ydHNjYW48L3RleHQ+Cjx0ZXh0IHg9IjI0IiB5PSIxNjgiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OXB4O2ZpbGw6IzY0NzQ4YiI+YSBmaXhlZCBzZXQgb2YgQVdTLXNwZWNpZmljIGZpbmRpbmctdHlwZSBzdHJpbmdzPC90ZXh0Pgo8bGluZSB4MT0iMzY2IiB5MT0iOTAiIHgyPSI0MjgiIHkyPSI5MCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2dkY2czKSIgc3R5bGU9InN0cm9rZTojZGMyNjI2Ii8+Cjx0ZXh0IHg9IjM5NyIgeT0iODIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OHB4Ij5yZXZpZXcgcnVsZXM8L3RleHQ+Cjx0ZXh0IHg9IjM5NyIgeT0iMTA2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjhweCI+Zm9yIHByb2JsZW0gdHlwZXM8L3RleHQ+Cjx0ZXh0IHg9IjQ0MCIgeT0iMjYiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiNkYzI2MjYiPkNMT1VEIEdVQVJEIFBST0JMRU1TIMK3IElUUyBPV04gREVURUNUT1IgUlVMRVM8L3RleHQ+CjxyZWN0IHg9IjQ0MCIgeT0iMzYiIHdpZHRoPSIzNzIiIGhlaWdodD0iMzAiIHJ4PSI3IiBzdHJva2Utd2lkdGg9IjEuMiIgc3R5bGU9ImZpbGw6I2ZlZjJmMjtzdHJva2U6I2ZlY2FjYSIvPgo8dGV4dCB4PSI0NTQiIHk9IjU2IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjEwcHg7ZmlsbDojMzM0MTU1Ij5TdXNwaWNpb3VzIGFjdGl2aXR5IG9uIGFuIGluc3RhbmNlPC90ZXh0Pgo8dGV4dCB4PSI4MDAiIHk9IjU2IiB0ZXh0LWFuY2hvcj0iZW5kIiBzdHlsZT0iZm9udDogNjAwIDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZpbGw6I2RjMjYyNiI+dmVyaWZ5PC90ZXh0Pgo8cmVjdCB4PSI0NDAiIHk9IjcyIiB3aWR0aD0iMzcyIiBoZWlnaHQ9IjMwIiByeD0iNyIgc3Ryb2tlLXdpZHRoPSIxLjIiIHN0eWxlPSJmaWxsOiNmZWYyZjI7c3Ryb2tlOiNmZWNhY2EiLz4KPHRleHQgeD0iNDU0IiB5PSI5MiIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6IzMzNDE1NSI+SW5zdGFuY2UgaXMgcHVibGljbHkgZXhwb3NlZDwvdGV4dD4KPHRleHQgeD0iODAwIiB5PSI5MiIgdGV4dC1hbmNob3I9ImVuZCIgc3R5bGU9ImZvbnQ6IDYwMCAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmaWxsOiNkYzI2MjYiPnZlcmlmeTwvdGV4dD4KPHJlY3QgeD0iNDQwIiB5PSIxMDgiIHdpZHRoPSIzNzIiIGhlaWdodD0iMzAiIHJ4PSI3IiBzdHJva2Utd2lkdGg9IjEuMiIgc3R5bGU9ImZpbGw6I2ZlZjJmMjtzdHJva2U6I2ZlY2FjYSIvPgo8dGV4dCB4PSI0NTQiIHk9IjEyOCIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6IzMzNDE1NSI+Umlza3kgcmVzb3VyY2UgY29uZmlndXJhdGlvbjwvdGV4dD4KPHRleHQgeD0iODAwIiB5PSIxMjgiIHRleHQtYW5jaG9yPSJlbmQiIHN0eWxlPSJmb250OiA2MDAgMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZmlsbDojZGMyNjI2Ij52ZXJpZnk8L3RleHQ+Cjx0ZXh0IHg9IjQ0MCIgeT0iMTY4IiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweDtmaWxsOiM2NDc0OGIiPmV4YW1wbGUgcHJvYmxlbSBhcmVhczsgdmVyaWZ5IHJ1bGVzIGFuZCBzZXZlcml0eTwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjE4OCIgd2lkdGg9Ijc4OCIgaGVpZ2h0PSI0OCIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuMyIgc3R5bGU9ImZpbGw6I2ZmZmJlYjtzdHJva2U6I2ZkZTY4YSIvPgo8dGV4dCB4PSI0MCIgeT0iMjEwIiBzdHlsZT0iZm9udDo3MDAgMTAuNXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojYjQ1MzA5Ij5GSU5ESU5HIE5BTUVTIERJRkZFUjwvdGV4dD4KPHRleHQgeD0iNDAiIHk9IjIyNiIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6IzMzNDE1NSI+VXBkYXRlIHJ1bGVzIHRoYXQgbWF0Y2ggR3VhcmREdXR5IGZpbmRpbmctdHlwZSBzdHJpbmdzIHRvIHVzZSBDbG91ZCBHdWFyZCBwcm9ibGVtIHR5cGVzLjwvdGV4dD4KPC9zdmc+)

![GuardDuty finding types such as UnauthorizedAccess:EC2/SSHBruteForce have no matching Cloud Guard problem names. Cloud Guard reports its own problems, such as suspicious activity on an instance; check each rule and severity.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjUwIiB2aWV3Qm94PSIwIDAgODM2IDI1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJHdWFyZER1dHkgZmluZGluZyB0eXBlcyBzdWNoIGFzIFVuYXV0aG9yaXplZEFjY2VzczpFQzIvU1NIQnJ1dGVGb3JjZSBoYXZlIG5vIG1hdGNoaW5nIENsb3VkIEd1YXJkIHByb2JsZW0gbmFtZXMuIENsb3VkIEd1YXJkIHJlcG9ydHMgaXRzIG93biBwcm9ibGVtcywgc3VjaCBhcyBzdXNwaWNpb3VzIGFjdGl2aXR5IG9uIGFuIGluc3RhbmNlOyBjaGVjayBlYWNoIHJ1bGUgYW5kIHNldmVyaXR5LiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJnZGNnMyIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojZjg3MTcxIi8+PC9tYXJrZXI+PC9kZWZzPgo8dGV4dCB4PSIyNCIgeT0iMjYiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiM5NGEzYjgiPkdVQVJERFVUWSBGSU5ESU5HIFRZUEVTIMK3IEEgRklYRUQgQ0FUQUxPRzwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjM2IiB3aWR0aD0iMzMwIiBoZWlnaHQ9IjMwIiByeD0iNyIgc3Ryb2tlLXdpZHRoPSIxLjIiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMzgiIHk9IjU2IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZm9udC1zaXplOjEwcHg7ZmlsbDojY2JkNWUxIj5VbmF1dGhvcml6ZWRBY2Nlc3M6RUMyL1NTSEJydXRlRm9yY2U8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSI3MiIgd2lkdGg9IjMzMCIgaGVpZ2h0PSIzMCIgcng9IjciIHN0cm9rZS13aWR0aD0iMS4yIiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjM4IiB5PSI5MiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6I2NiZDVlMSI+Q3J5cHRvQ3VycmVuY3k6RUMyL0JpdGNvaW5Ub29sLkI8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSIxMDgiIHdpZHRoPSIzMzAiIGhlaWdodD0iMzAiIHJ4PSI3IiBzdHJva2Utd2lkdGg9IjEuMiIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIzOCIgeT0iMTI4IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZm9udC1zaXplOjEwcHg7ZmlsbDojY2JkNWUxIj5SZWNvbjpFQzIvUG9ydHNjYW48L3RleHQ+Cjx0ZXh0IHg9IjI0IiB5PSIxNjgiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OXB4O2ZpbGw6Izk0YTNiOCI+YSBmaXhlZCBzZXQgb2YgQVdTLXNwZWNpZmljIGZpbmRpbmctdHlwZSBzdHJpbmdzPC90ZXh0Pgo8bGluZSB4MT0iMzY2IiB5MT0iOTAiIHgyPSI0MjgiIHkyPSI5MCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2dkY2czKSIgc3R5bGU9InN0cm9rZTojZjg3MTcxIi8+Cjx0ZXh0IHg9IjM5NyIgeT0iODIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OHB4Ij5yZXZpZXcgcnVsZXM8L3RleHQ+Cjx0ZXh0IHg9IjM5NyIgeT0iMTA2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjhweCI+Zm9yIHByb2JsZW0gdHlwZXM8L3RleHQ+Cjx0ZXh0IHg9IjQ0MCIgeT0iMjYiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiNmODcxNzEiPkNMT1VEIEdVQVJEIFBST0JMRU1TIMK3IElUUyBPV04gREVURUNUT1IgUlVMRVM8L3RleHQ+CjxyZWN0IHg9IjQ0MCIgeT0iMzYiIHdpZHRoPSIzNzIiIGhlaWdodD0iMzAiIHJ4PSI3IiBzdHJva2Utd2lkdGg9IjEuMiIgc3R5bGU9ImZpbGw6IzQ1MGEwYTtzdHJva2U6IzdmMWQxZCIvPgo8dGV4dCB4PSI0NTQiIHk9IjU2IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjEwcHg7ZmlsbDojY2JkNWUxIj5TdXNwaWNpb3VzIGFjdGl2aXR5IG9uIGFuIGluc3RhbmNlPC90ZXh0Pgo8dGV4dCB4PSI4MDAiIHk9IjU2IiB0ZXh0LWFuY2hvcj0iZW5kIiBzdHlsZT0iZm9udDogNjAwIDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZpbGw6I2Y4NzE3MSI+dmVyaWZ5PC90ZXh0Pgo8cmVjdCB4PSI0NDAiIHk9IjcyIiB3aWR0aD0iMzcyIiBoZWlnaHQ9IjMwIiByeD0iNyIgc3Ryb2tlLXdpZHRoPSIxLjIiIHN0eWxlPSJmaWxsOiM0NTBhMGE7c3Ryb2tlOiM3ZjFkMWQiLz4KPHRleHQgeD0iNDU0IiB5PSI5MiIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6I2NiZDVlMSI+SW5zdGFuY2UgaXMgcHVibGljbHkgZXhwb3NlZDwvdGV4dD4KPHRleHQgeD0iODAwIiB5PSI5MiIgdGV4dC1hbmNob3I9ImVuZCIgc3R5bGU9ImZvbnQ6IDYwMCAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmaWxsOiNmODcxNzEiPnZlcmlmeTwvdGV4dD4KPHJlY3QgeD0iNDQwIiB5PSIxMDgiIHdpZHRoPSIzNzIiIGhlaWdodD0iMzAiIHJ4PSI3IiBzdHJva2Utd2lkdGg9IjEuMiIgc3R5bGU9ImZpbGw6IzQ1MGEwYTtzdHJva2U6IzdmMWQxZCIvPgo8dGV4dCB4PSI0NTQiIHk9IjEyOCIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6I2NiZDVlMSI+Umlza3kgcmVzb3VyY2UgY29uZmlndXJhdGlvbjwvdGV4dD4KPHRleHQgeD0iODAwIiB5PSIxMjgiIHRleHQtYW5jaG9yPSJlbmQiIHN0eWxlPSJmb250OiA2MDAgMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZmlsbDojZjg3MTcxIj52ZXJpZnk8L3RleHQ+Cjx0ZXh0IHg9IjQ0MCIgeT0iMTY4IiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweDtmaWxsOiM5NGEzYjgiPmV4YW1wbGUgcHJvYmxlbSBhcmVhczsgdmVyaWZ5IHJ1bGVzIGFuZCBzZXZlcml0eTwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjE4OCIgd2lkdGg9Ijc4OCIgaGVpZ2h0PSI0OCIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuMyIgc3R5bGU9ImZpbGw6IzQyMjAwNjtzdHJva2U6IzkyNDAwZSIvPgo8dGV4dCB4PSI0MCIgeT0iMjEwIiBzdHlsZT0iZm9udDo3MDAgMTAuNXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojZmJiZjI0Ij5GSU5ESU5HIE5BTUVTIERJRkZFUjwvdGV4dD4KPHRleHQgeD0iNDAiIHk9IjIyNiIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6I2NiZDVlMSI+VXBkYXRlIHJ1bGVzIHRoYXQgbWF0Y2ggR3VhcmREdXR5IGZpbmRpbmctdHlwZSBzdHJpbmdzIHRvIHVzZSBDbG91ZCBHdWFyZCBwcm9ibGVtIHR5cGVzLjwvdGV4dD4KPC9zdmc+)

Cloud Guard uses its own problem types. Rewrite each rule that matches a GuardDuty finding type.

#### Detection sources

Cloud Guard Activity, Configuration and Threat recipes analyze OCI Audit events, resource settings and threat signals. The specific rules and available data determine coverage. Configuration checks are a separate capability from GuardDuty threat detection.

Review GuardDuty VPC Flow Log network analysis and EKS audit-log scenarios individually. Cloud Guard's configuration checks do not replace those detections. Document missing scenarios and decide whether other OCI controls can meet the application's requirements.

![Each GuardDuty detection source compared with the OCI signal and Cloud Guard detector that covers it. Cloud Guard has no VPC Flow Log network detection, and container coverage is partial.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjM0IiB2aWV3Qm94PSIwIDAgODM2IDIzNCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJFYWNoIEd1YXJkRHV0eSBkZXRlY3Rpb24gc291cmNlIGNvbXBhcmVkIHdpdGggdGhlIE9DSSBzaWduYWwgYW5kIENsb3VkIEd1YXJkIGRldGVjdG9yIHRoYXQgY292ZXJzIGl0LiBDbG91ZCBHdWFyZCBoYXMgbm8gVlBDIEZsb3cgTG9nIG5ldHdvcmsgZGV0ZWN0aW9uLCBhbmQgY29udGFpbmVyIGNvdmVyYWdlIGlzIHBhcnRpYWwuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+Cjx0ZXh0IHg9IjI0IiB5PSIyNCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzMzNDE1NSI+REVURUNUSU9OIFNPVVJDRVMgwrcgR1VBUkREVVRZIOKGkiBPQ0kgVEVMRU1FVFJZIMK3IENMT1VEIEdVQVJEIERFVEVDVE9SPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMzYiIHdpZHRoPSI3ODgiIGhlaWdodD0iMzQiIHJ4PSI3IiBzdHJva2Utd2lkdGg9IjEuMSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2Y4ZmFmYyIvPgo8dGV4dCB4PSIzOCIgeT0iNTciIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmb250LXNpemU6OS41cHg7ZmlsbDojNjQ3NDhiIj5DbG91ZFRyYWlsIG1hbmFnZW1lbnQgZXZlbnRzPC90ZXh0Pgo8dGV4dCB4PSIzMzAiIHk9IjU3IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjEwcHg7ZmlsbDojMzM0MTU1Ij5PQ0kgQXVkaXQgZXZlbnRzPC90ZXh0Pgo8dGV4dCB4PSI4MDAiIHk9IjU3IiB0ZXh0LWFuY2hvcj0iZW5kIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweDtmaWxsOiNkYzI2MjYiPkFjdGl2aXR5IERldGVjdG9yPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iNzQiIHdpZHRoPSI3ODgiIGhlaWdodD0iMzQiIHJ4PSI3IiBzdHJva2Utd2lkdGg9IjEuMSIgc3R5bGU9ImZpbGw6I2VjZmRmNTtzdHJva2U6I2VjZmRmNSIvPgo8dGV4dCB4PSIzOCIgeT0iOTUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmb250LXNpemU6OS41cHg7ZmlsbDojNjQ3NDhiIj5SZXNvdXJjZSBjb25maWd1cmF0aW9uPC90ZXh0Pgo8dGV4dCB4PSIzMzAiIHk9Ijk1IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjEwcHg7ZmlsbDojMzM0MTU1Ij5jb25maWd1cmF0aW9uIGNoYW5nZXMgYW5kIHJpc2tzPC90ZXh0Pgo8dGV4dCB4PSI4MDAiIHk9Ijk1IiB0ZXh0LWFuY2hvcj0iZW5kIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweDtmaWxsOiMwNDc4NTciPkNvbmZpZ3VyYXRpb24gRGV0ZWN0b3I8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSIxMTIiIHdpZHRoPSI3ODgiIGhlaWdodD0iMzQiIHJ4PSI3IiBzdHJva2Utd2lkdGg9IjEuMSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2Y4ZmFmYyIvPgo8dGV4dCB4PSIzOCIgeT0iMTMzIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZm9udC1zaXplOjkuNXB4O2ZpbGw6IzY0NzQ4YiI+VGhyZWF0LWludGVsIG1hdGNoaW5nPC90ZXh0Pgo8dGV4dCB4PSIzMzAiIHk9IjEzMyIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6IzMzNDE1NSI+bWF0Y2hlZCBhZ2FpbnN0IHRocmVhdCBmZWVkczwvdGV4dD4KPHRleHQgeD0iODAwIiB5PSIxMzMiIHRleHQtYW5jaG9yPSJlbmQiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OXB4O2ZpbGw6I2RjMjYyNiI+VGhyZWF0IERldGVjdG9yPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMTUwIiB3aWR0aD0iNzg4IiBoZWlnaHQ9IjM0IiByeD0iNyIgc3Ryb2tlLXdpZHRoPSIxLjEiIHN0eWxlPSJmaWxsOiNmZmZiZWI7c3Ryb2tlOiNmZGU2OGEiLz4KPHRleHQgeD0iMzgiIHk9IjE3MSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZvbnQtc2l6ZTo5LjVweDtmaWxsOiM2NDc0OGIiPlZQQyBGbG93IExvZ3M8L3RleHQ+Cjx0ZXh0IHg9IjMzMCIgeT0iMTcxIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjEwcHg7ZmlsbDojMzM0MTU1Ij5hY3Rpdml0eSAvIGNvbmZpZy1jZW50cmljPC90ZXh0Pgo8dGV4dCB4PSI4MDAiIHk9IjE3MSIgdGV4dC1hbmNob3I9ImVuZCIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojYjQ1MzA5Ij5uZXR3b3JrIGRldGVjdGlvbiBnYXA8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSIxODgiIHdpZHRoPSI3ODgiIGhlaWdodD0iMzQiIHJ4PSI3IiBzdHJva2Utd2lkdGg9IjEuMSIgc3R5bGU9ImZpbGw6I2ZmZmJlYjtzdHJva2U6I2ZkZTY4YSIvPgo8dGV4dCB4PSIzOCIgeT0iMjA5IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZm9udC1zaXplOjkuNXB4O2ZpbGw6IzY0NzQ4YiI+RUtTIGF1ZGl0IGxvZ3M8L3RleHQ+Cjx0ZXh0IHg9IjMzMCIgeT0iMjA5IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjEwcHg7ZmlsbDojMzM0MTU1Ij5PS0UgwrcgY29udGFpbmVyIHNpZ25hbHM8L3RleHQ+Cjx0ZXh0IHg9IjgwMCIgeT0iMjA5IiB0ZXh0LWFuY2hvcj0iZW5kIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweDtmaWxsOiNiNDUzMDkiPmNvbnRhaW5lciB3b3JrbG9hZHMgwrcgcGFydGlhbDwvdGV4dD4KPC9zdmc+)

![Each GuardDuty detection source compared with the OCI signal and Cloud Guard detector that covers it. Cloud Guard has no VPC Flow Log network detection, and container coverage is partial.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjM0IiB2aWV3Qm94PSIwIDAgODM2IDIzNCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJFYWNoIEd1YXJkRHV0eSBkZXRlY3Rpb24gc291cmNlIGNvbXBhcmVkIHdpdGggdGhlIE9DSSBzaWduYWwgYW5kIENsb3VkIEd1YXJkIGRldGVjdG9yIHRoYXQgY292ZXJzIGl0LiBDbG91ZCBHdWFyZCBoYXMgbm8gVlBDIEZsb3cgTG9nIG5ldHdvcmsgZGV0ZWN0aW9uLCBhbmQgY29udGFpbmVyIGNvdmVyYWdlIGlzIHBhcnRpYWwuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+Cjx0ZXh0IHg9IjI0IiB5PSIyNCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6I2NiZDVlMSI+REVURUNUSU9OIFNPVVJDRVMgwrcgR1VBUkREVVRZIOKGkiBPQ0kgVEVMRU1FVFJZIMK3IENMT1VEIEdVQVJEIERFVEVDVE9SPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMzYiIHdpZHRoPSI3ODgiIGhlaWdodD0iMzQiIHJ4PSI3IiBzdHJva2Utd2lkdGg9IjEuMSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzBmMTcyYSIvPgo8dGV4dCB4PSIzOCIgeT0iNTciIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmb250LXNpemU6OS41cHg7ZmlsbDojOTRhM2I4Ij5DbG91ZFRyYWlsIG1hbmFnZW1lbnQgZXZlbnRzPC90ZXh0Pgo8dGV4dCB4PSIzMzAiIHk9IjU3IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjEwcHg7ZmlsbDojY2JkNWUxIj5PQ0kgQXVkaXQgZXZlbnRzPC90ZXh0Pgo8dGV4dCB4PSI4MDAiIHk9IjU3IiB0ZXh0LWFuY2hvcj0iZW5kIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweDtmaWxsOiNmODcxNzEiPkFjdGl2aXR5IERldGVjdG9yPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iNzQiIHdpZHRoPSI3ODgiIGhlaWdodD0iMzQiIHJ4PSI3IiBzdHJva2Utd2lkdGg9IjEuMSIgc3R5bGU9ImZpbGw6IzA2NGUzYjtzdHJva2U6IzA2NGUzYiIvPgo8dGV4dCB4PSIzOCIgeT0iOTUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmb250LXNpemU6OS41cHg7ZmlsbDojOTRhM2I4Ij5SZXNvdXJjZSBjb25maWd1cmF0aW9uPC90ZXh0Pgo8dGV4dCB4PSIzMzAiIHk9Ijk1IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjEwcHg7ZmlsbDojY2JkNWUxIj5jb25maWd1cmF0aW9uIGNoYW5nZXMgYW5kIHJpc2tzPC90ZXh0Pgo8dGV4dCB4PSI4MDAiIHk9Ijk1IiB0ZXh0LWFuY2hvcj0iZW5kIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweDtmaWxsOiM2ZWU3YjciPkNvbmZpZ3VyYXRpb24gRGV0ZWN0b3I8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSIxMTIiIHdpZHRoPSI3ODgiIGhlaWdodD0iMzQiIHJ4PSI3IiBzdHJva2Utd2lkdGg9IjEuMSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzBmMTcyYSIvPgo8dGV4dCB4PSIzOCIgeT0iMTMzIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZm9udC1zaXplOjkuNXB4O2ZpbGw6Izk0YTNiOCI+VGhyZWF0LWludGVsIG1hdGNoaW5nPC90ZXh0Pgo8dGV4dCB4PSIzMzAiIHk9IjEzMyIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZToxMHB4O2ZpbGw6I2NiZDVlMSI+bWF0Y2hlZCBhZ2FpbnN0IHRocmVhdCBmZWVkczwvdGV4dD4KPHRleHQgeD0iODAwIiB5PSIxMzMiIHRleHQtYW5jaG9yPSJlbmQiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OXB4O2ZpbGw6I2Y4NzE3MSI+VGhyZWF0IERldGVjdG9yPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMTUwIiB3aWR0aD0iNzg4IiBoZWlnaHQ9IjM0IiByeD0iNyIgc3Ryb2tlLXdpZHRoPSIxLjEiIHN0eWxlPSJmaWxsOiM0MjIwMDY7c3Ryb2tlOiM5MjQwMGUiLz4KPHRleHQgeD0iMzgiIHk9IjE3MSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZvbnQtc2l6ZTo5LjVweDtmaWxsOiM5NGEzYjgiPlZQQyBGbG93IExvZ3M8L3RleHQ+Cjx0ZXh0IHg9IjMzMCIgeT0iMTcxIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjEwcHg7ZmlsbDojY2JkNWUxIj5hY3Rpdml0eSAvIGNvbmZpZy1jZW50cmljPC90ZXh0Pgo8dGV4dCB4PSI4MDAiIHk9IjE3MSIgdGV4dC1hbmNob3I9ImVuZCIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojZmJiZjI0Ij5uZXR3b3JrIGRldGVjdGlvbiBnYXA8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSIxODgiIHdpZHRoPSI3ODgiIGhlaWdodD0iMzQiIHJ4PSI3IiBzdHJva2Utd2lkdGg9IjEuMSIgc3R5bGU9ImZpbGw6IzQyMjAwNjtzdHJva2U6IzkyNDAwZSIvPgo8dGV4dCB4PSIzOCIgeT0iMjA5IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZm9udC1zaXplOjkuNXB4O2ZpbGw6Izk0YTNiOCI+RUtTIGF1ZGl0IGxvZ3M8L3RleHQ+Cjx0ZXh0IHg9IjMzMCIgeT0iMjA5IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjEwcHg7ZmlsbDojY2JkNWUxIj5PS0UgwrcgY29udGFpbmVyIHNpZ25hbHM8L3RleHQ+Cjx0ZXh0IHg9IjgwMCIgeT0iMjA5IiB0ZXh0LWFuY2hvcj0iZW5kIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweDtmaWxsOiNmYmJmMjQiPmNvbnRhaW5lciB3b3JrbG9hZHMgwrcgcGFydGlhbDwvdGV4dD4KPC9zdmc+)

Cloud Guard offers configuration checks; they do not fill network or container detection gaps.

#### Detector and responder recipes

Attach the detector recipes you need to the target and tune their rules. Check the problems raised for your resources; choosing a recipe by name does not give equivalent coverage.

Responder recipes can act on problems by changing public bucket access or security-list rules. Review the actions and resources they can affect, then configure and test the intended responses. See [Oracle's target guide](https://docs.oracle.com/en-us/iaas/Content/cloud-guard/using/targets-create.htm) for recipe selection.

![Detector recipes attached to your compartment target raise problems. Responder recipes, if you configure them, can change the affected resources.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTY4IiB2aWV3Qm94PSIwIDAgODM2IDE2OCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJEZXRlY3RvciByZWNpcGVzIGF0dGFjaGVkIHRvIHlvdXIgY29tcGFydG1lbnQgdGFyZ2V0IHJhaXNlIHByb2JsZW1zLiBSZXNwb25kZXIgcmVjaXBlcywgaWYgeW91IGNvbmZpZ3VyZSB0aGVtLCBjYW4gY2hhbmdlIHRoZSBhZmZlY3RlZCByZXNvdXJjZXMuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImdkY2c1IiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiNkYzI2MjYiLz48L21hcmtlcj48bWFya2VyIGlkPSJnZGNnNWciIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzA0Nzg1NyIvPjwvbWFya2VyPjwvZGVmcz4KPHRleHQgeD0iMjQiIHk9IjI2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojZGMyNjI2Ij5ERVRFQ1RJT04gUlVMRVMgQU5EIFJFU1BPTlNFIEFDVElPTlM8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSI0NCIgd2lkdGg9IjEyMCIgaGVpZ2h0PSI2NCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI4NCIgeT0iNzIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTAuNXB4Ij50aGUgdGFyZ2V0PC90ZXh0Pgo8dGV4dCB4PSI4NCIgeT0iOTAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OXB4Ij55b3VyIGNvbXBhcnRtZW50PC90ZXh0Pgo8bGluZSB4MT0iMTQ2IiB5MT0iNzYiIHgyPSIxNzAiIHkyPSI3NiIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2dkY2c1KSIgc3R5bGU9InN0cm9rZTojZGMyNjI2Ii8+CjxyZWN0IHg9IjE3MiIgeT0iNDAiIHdpZHRoPSIxODAiIGhlaWdodD0iNzIiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiNmZWYyZjI7c3Ryb2tlOiNkYzI2MjYiLz4KPHRleHQgeD0iMjYyIiB5PSI2NiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMC41cHg7ZmlsbDojZGMyNjI2Ij5EZXRlY3RvciByZWNpcGVzPC90ZXh0Pgo8dGV4dCB4PSIyNjIiIHk9Ijg0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweCI+QWN0aXZpdHkgwrcgQ29uZmlndXJhdGlvbiDCtyBUaHJlYXQ8L3RleHQ+CjxsaW5lIHgxPSIzNTIiIHkxPSI3NiIgeDI9IjM3OCIgeTI9Ijc2IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZ2RjZzUpIiBzdHlsZT0ic3Ryb2tlOiNkYzI2MjYiLz4KPHJlY3QgeD0iMzgwIiB5PSI0NCIgd2lkdGg9IjEyMCIgaGVpZ2h0PSI2NCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI0NDAiIHk9IjcyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjEwLjVweCI+UHJvYmxlbXM8L3RleHQ+Cjx0ZXh0IHg9IjQ0MCIgeT0iOTAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OXB4Ij5zZXZlcml0eS1zY29yZWQ8L3RleHQ+CjxsaW5lIHgxPSI1MDAiIHkxPSI3NiIgeDI9IjUyNiIgeTI9Ijc2IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZ2RjZzVnKSIgc3R5bGU9InN0cm9rZTojMDQ3ODU3Ii8+CjxyZWN0IHg9IjUyOCIgeT0iNDAiIHdpZHRoPSIxODAiIGhlaWdodD0iNzIiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNjE4IiB5PSI2NiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMC41cHgiPlJlc3BvbmRlciByZWNpcGVzPC90ZXh0Pgo8dGV4dCB4PSI2MTgiIHk9Ijg0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6OXB4Ij5hdXRvLXJlbWVkaWF0ZSBhIHByb2JsZW08L3RleHQ+Cjx0ZXh0IHg9IjQxOCIgeT0iMTQwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweDtmaWxsOiNiNDUzMDkiPnJlc3BvbmRlciByZWNpcGVzIGFjdCBvbiBsaXZlIHJlc291cmNlcywgc28gYXV0by1yZW1lZGlhdGlvbiBpcyBvcHQtaW4gYW5kIHNjb3BlZCBkZWxpYmVyYXRlbHk8L3RleHQ+Cjwvc3ZnPg==)

![Detector recipes attached to your compartment target raise problems. Responder recipes, if you configure them, can change the affected resources.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTY4IiB2aWV3Qm94PSIwIDAgODM2IDE2OCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJEZXRlY3RvciByZWNpcGVzIGF0dGFjaGVkIHRvIHlvdXIgY29tcGFydG1lbnQgdGFyZ2V0IHJhaXNlIHByb2JsZW1zLiBSZXNwb25kZXIgcmVjaXBlcywgaWYgeW91IGNvbmZpZ3VyZSB0aGVtLCBjYW4gY2hhbmdlIHRoZSBhZmZlY3RlZCByZXNvdXJjZXMuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImdkY2c1IiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiNmODcxNzEiLz48L21hcmtlcj48bWFya2VyIGlkPSJnZGNnNWciIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzZlZTdiNyIvPjwvbWFya2VyPjwvZGVmcz4KPHRleHQgeD0iMjQiIHk9IjI2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojZjg3MTcxIj5ERVRFQ1RJT04gUlVMRVMgQU5EIFJFU1BPTlNFIEFDVElPTlM8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSI0NCIgd2lkdGg9IjEyMCIgaGVpZ2h0PSI2NCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI4NCIgeT0iNzIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTAuNXB4Ij50aGUgdGFyZ2V0PC90ZXh0Pgo8dGV4dCB4PSI4NCIgeT0iOTAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OXB4Ij55b3VyIGNvbXBhcnRtZW50PC90ZXh0Pgo8bGluZSB4MT0iMTQ2IiB5MT0iNzYiIHgyPSIxNzAiIHkyPSI3NiIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2dkY2c1KSIgc3R5bGU9InN0cm9rZTojZjg3MTcxIi8+CjxyZWN0IHg9IjE3MiIgeT0iNDAiIHdpZHRoPSIxODAiIGhlaWdodD0iNzIiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiM0NTBhMGE7c3Ryb2tlOiNmODcxNzEiLz4KPHRleHQgeD0iMjYyIiB5PSI2NiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMC41cHg7ZmlsbDojZjg3MTcxIj5EZXRlY3RvciByZWNpcGVzPC90ZXh0Pgo8dGV4dCB4PSIyNjIiIHk9Ijg0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweCI+QWN0aXZpdHkgwrcgQ29uZmlndXJhdGlvbiDCtyBUaHJlYXQ8L3RleHQ+CjxsaW5lIHgxPSIzNTIiIHkxPSI3NiIgeDI9IjM3OCIgeTI9Ijc2IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZ2RjZzUpIiBzdHlsZT0ic3Ryb2tlOiNmODcxNzEiLz4KPHJlY3QgeD0iMzgwIiB5PSI0NCIgd2lkdGg9IjEyMCIgaGVpZ2h0PSI2NCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI0NDAiIHk9IjcyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjEwLjVweCI+UHJvYmxlbXM8L3RleHQ+Cjx0ZXh0IHg9IjQ0MCIgeT0iOTAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OXB4Ij5zZXZlcml0eS1zY29yZWQ8L3RleHQ+CjxsaW5lIHgxPSI1MDAiIHkxPSI3NiIgeDI9IjUyNiIgeTI9Ijc2IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZ2RjZzVnKSIgc3R5bGU9InN0cm9rZTojNmVlN2I3Ii8+CjxyZWN0IHg9IjUyOCIgeT0iNDAiIHdpZHRoPSIxODAiIGhlaWdodD0iNzIiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iNjE4IiB5PSI2NiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMC41cHgiPlJlc3BvbmRlciByZWNpcGVzPC90ZXh0Pgo8dGV4dCB4PSI2MTgiIHk9Ijg0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6OXB4Ij5hdXRvLXJlbWVkaWF0ZSBhIHByb2JsZW08L3RleHQ+Cjx0ZXh0IHg9IjQxOCIgeT0iMTQwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweDtmaWxsOiNmYmJmMjQiPnJlc3BvbmRlciByZWNpcGVzIGFjdCBvbiBsaXZlIHJlc291cmNlcywgc28gYXV0by1yZW1lZGlhdGlvbiBpcyBvcHQtaW4gYW5kIHNjb3BlZCBkZWxpYmVyYXRlbHk8L3RleHQ+Cjwvc3ZnPg==)

Detector recipes produce problems. Separately configured responder recipes can act on affected resources.

#### Limitations

Where Cloud Guard and GuardDuty differ

* **You must attach detector recipes.** Tensor9 enables Cloud Guard and creates the target, but detection depends on the recipes attached to it. Check the rules you need before relying on detection, and configure responder actions separately.
* **Finding names behave differently: rules that match GuardDuty names stop matching.** Rules matching `UnauthorizedAccess:EC2/SSHBruteForce` or `CryptoCurrency:*` must be rewritten for Cloud Guard problem types and behaviour.
* **GuardDuty filters, IP sets, threat feeds and publishing destinations are not recreated.** The build reports each `aws_guardduty_filter`, `aws_guardduty_ipset`, `aws_guardduty_threatintelset` and `aws_guardduty_publishing_destination` it does not transfer. Decide which Cloud Guard rules or lists meet each requirement.
* **Network and container detection are not fully supported.** Cloud Guard configuration checks do not replace GuardDuty VPC Flow Log analysis or EKS audit-log coverage. If your detector uses EKS audit logs, S3 data events or malware scanning, the build reports a warning for each.

#### Other considerations

* **What Tensor9 creates.** Tensor9 enables Cloud Guard and creates a compartment target. Historical GuardDuty findings are not copied, and creating the target does not prove that detection is active.
* **Reporting region and recipes.** Confirm the reporting region and the recipes attached to the target. Turn on responder recipes only for the actions you want automated.
* **Response automation.** Configure OCI Events rules or responder recipes yourself. Review which resources a responder can change, and test each response before you rely on it.
* **Outputs keep working.** Terraform outputs that read the detector's `id`, `arn` or `account_id` still resolve; they return the detector's name.

## Install and run

The documentation and SLAs are public. Downloading and running the Cloud Adapter binary requires an entitled customer account. Set `T9_API_KEY` as described in [Install and Authenticate](https://docs.tensor9.com/cloud-adapter-early-access/getting-started/install-and-authenticate.md), then list the adapters your account may use with this origin:

```sh theme={null}
tensor9 adapt svc list \
  -origin aws::1.0.0::guardduty
```

The result is limited to directed mappings for this origin that your account is entitled to use. Use a returned backend identifier when configuring the adapter or investigating a request.

Request binary access from [hello@tensor9.com](mailto:hello@tensor9.com) if your account does not yet include this direction.

## Existing data and credentials

Selecting a backend does not copy existing data, credentials or access policies. Plan and verify migration separately before changing an application's endpoint. Do not assume an identifier, credential or encrypted value from the origin service works unchanged on the target.

## Configure, tune and debug

Start with [setup](https://docs.tensor9.com/cloud-adapter-early-access/getting-started/overview.md) and [configuration](https://docs.tensor9.com/cloud-adapter-early-access/configuration/overview.md). Use [tuning](https://docs.tensor9.com/cloud-adapter-early-access/tuning/overview.md) to understand supported request tags, [debugging](https://docs.tensor9.com/cloud-adapter-early-access/debugging/overview.md) to investigate a request, and [High Fidelity Cloud Emulators](https://docs.tensor9.com/cloud-adapter-early-access/local-testing/overview.md) to validate a bounded reproduction.

For requests that go through an entitled service adapter, use [tensor9 explain](https://docs.tensor9.com/cloud-adapter-early-access/debugging/explain.md) and [x-t9-explain](https://docs.tensor9.com/cloud-adapter-early-access/debugging/response-headers.md) to inspect the selected mapping.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.