AWS Guard Duty Tables

Tables

AWSGuardDutyEBSScanThreats

Stores individual threat detections identified during Amazon GuardDuty EBS malware scans, including threat name, severity, and affected file paths.

Name	Type	Description
ConfigID	integer	Unique identifier of the configuration associated with this EBS scan threat record.
ID	integer	Auto-incremented primary key for the EBS scan threat row.
FindingID	string	Identifier of the GuardDuty finding that triggered this EBS scan threat.
Name	string	Name of the malware threat detected during the EBS volume scan (e.g., `Trojan:Linux/Xorddos`).
Severity	string	Severity level of the detected threat (e.g., `HIGH`, `MEDIUM`, `LOW`).
ItemCount	integer	Number of files or items associated with this threat finding.
FilePathsSerialized	string	Serialized list of file paths where the threat was detected on the EBS volume.
AWSGuardDutyFindingsModelConfigID	integer	Foreign key referencing the ConfigID of the parent AWSGuardDutyFindings record.
AWSGuardDutyFindingsModelFindingID	string	Foreign key referencing the FindingID of the parent AWSGuardDutyFindings record.
BatchDate	datetime	Timestamp when this record was ingested during the batch processing run.

AWSGuardDutyEBSVolumeDetails

Contains metadata about EBS volumes scanned by Amazon GuardDuty, including volume type, size, encryption configuration, and associated ARNs.

Name	Type	Description
ConfigID	integer	Unique identifier of the configuration associated with this EBS volume detail record.
ID	integer	Auto-incremented primary key for the EBS volume detail row.
FindingID	string	Identifier of the GuardDuty finding associated with this EBS volume.
VolumeDetailType	string	Classification of the EBS volume detail (e.g., `SCANNED`, `SKIPPED`).
DeviceName	string	Device name of the EBS volume as attached to the instance (e.g., `/dev/xvda`, `/dev/sdb`).
EncryptionType	string	Encryption method applied to the EBS volume (e.g., `AWS_MANAGED_KMS_KEY`, `CUSTOMER_MANAGED_KMS_KEY`).
KmsKeyARN	string	ARN of the KMS key used to encrypt the EBS volume.
SnapshotARN	string	ARN of the EBS snapshot created from this volume for scanning.
VolumeARN	string	ARN of the EBS volume associated with the GuardDuty finding.
VolumeSizeInGB	integer	Size of the EBS volume in gigabytes.
VolumeType	string	EBS volume type (e.g., `gp2`, `gp3`, `io1`, `st1`).
AWSGuardDutyFindingsModelConfigID	integer	Foreign key referencing the ConfigID of the parent AWSGuardDutyFindings record.
AWSGuardDutyFindingsModelFindingID	string	Foreign key referencing the FindingID of the parent AWSGuardDutyFindings record.
BatchDate	datetime	Timestamp when this record was ingested during the batch processing run.

AWSGuardDutyFindingContainers

Records container-level details associated with Amazon GuardDuty findings, including image, runtime, security context, and volume mount information.

Name	Type	Description
ConfigID	integer	Unique identifier of the configuration associated with this container record.
ID	integer	Auto-incremented primary key for the finding container row.
FindingID	string	Identifier of the GuardDuty finding associated with this container.
ContainerSource	string	Source type of the container resource (e.g., `ECS`, `EKS`).
ContainerRuntime	string	Container runtime environment (e.g., `containerd`, `docker`).
ContainerID	string	Unique identifier of the container involved in the finding.
Image	string	Full container image name including registry and tag (e.g., `123456789.dkr.ecr.us-east-1.amazonaws.com/myapp:latest`).
ImagePrefix	string	Registry and repository prefix of the container image, excluding the tag.
Name	string	Name assigned to the container within the task or pod.
SecurityContextAllowPrivilegeEscalation	boolean	Indicates whether the container's security context allows privilege escalation.
SecurityContextPrivileged	boolean	Indicates whether the container is running in privileged mode.
VolumeMountsSerialized	string	Serialized list of volume mounts configured for the container.
AWSGuardDutyFindingsModelConfigID	integer	Foreign key referencing the ConfigID of the parent AWSGuardDutyFindings record.
AWSGuardDutyFindingsModelFindingID	string	Foreign key referencing the FindingID of the parent AWSGuardDutyFindings record.
BatchDate	datetime	Timestamp when this record was ingested during the batch processing run.

AWSGuardDutyFindings

Central table storing Amazon GuardDuty security findings, including finding metadata, severity, resource details, service action context, and runtime monitoring information.

Name	Type	Description
AccountID	string	AWS account ID in which the GuardDuty finding was generated.
DetectorID	string	ID of the GuardDuty detector that generated this finding.
Description	string	Human-readable description explaining the nature and context of the finding.
ARN	string	Full Amazon Resource Name of the GuardDuty finding.
ServiceUserFeedback	string	User-provided feedback on the finding (e.g., `USEFUL`, `NOT_USEFUL`).
Partition	string	AWS partition in which the finding was generated (e.g., `aws`, `aws-cn`, `aws-us-gov`).
Region	string	AWS region where the finding was generated (e.g., `us-east-1`, `eu-west-2`).
SchemaVersion	string	Version of the GuardDuty finding schema used for this record.
Title	string	Short, human-readable title summarizing the finding type.
Type	string	GuardDuty finding type identifier (e.g., `UnauthorizedAccess:EC2/SSHBruteForce`).
Confidence	float	Confidence score (0-100) representing how likely the finding indicates a threat.
Severity	float	Numeric severity score of the finding (e.g., 2.0 = LOW, 5.0 = MEDIUM, 8.0 = HIGH).

AWSGuardDutyMalwareThreats

Contains malware threat details identified during GuardDuty malware protection scans, including threat name, hash, source, and affected item paths.

Name	Type	Description
ConfigID	integer	Unique identifier of the configuration associated with this malware threat record.
ID	integer	Auto-incremented primary key for the malware threat row.
FindingID	string	Identifier of the GuardDuty finding associated with this malware threat.
Name	string	Name of the detected malware threat (e.g., `Trojan:Linux/Xorddos`, `CoinMiner`).
Source	string	Detection source that identified the malware threat (e.g., `SCAN_FILE`).
Count	integer	Number of items (files or objects) associated with this specific malware threat.
Hash	string	Cryptographic hash (e.g., SHA-256) of the malware file or artifact.
ItemDetailsSerialized	string	Serialized details of individual items containing this malware threat.
ItemPathsSerialized	string	Serialized list of file paths where this malware threat was found.
AWSGuardDutyFindingsModelConfigID	integer	Foreign key referencing the ConfigID of the parent AWSGuardDutyFindings record.
AWSGuardDutyFindingsModelFindingID	string	Foreign key referencing the FindingID of the parent AWSGuardDutyFindings record.
BatchDate	datetime	Timestamp when this record was ingested during the batch processing run.

AWSGuardDutyMembers

Stores GuardDuty member account relationships, including membership status, administrator association, and invitation timestamps.

Name	Type	Description
AccountID	string	AWS account ID of the GuardDuty member account.
AdministratorID	string	AWS account ID of the GuardDuty administrator managing this member.
DetectorID	string	ID of the GuardDuty detector in the administrator account.
MemberDetectorID	string	ID of the GuardDuty detector in the member account.
Email	string	Email address associated with the member account.
MasterID	string	Deprecated field; AWS account ID of the GuardDuty master (administrator) account.
RelationshipStatus	string	Status of the membership relationship (e.g., `Enabled`, `Invited`, `Removed`).
InvitedAt	datetime	Timestamp when the membership invitation was sent to the member account.
UpdatedAt	datetime	Timestamp when the member record was last updated.
BatchDate	datetime	Timestamp when this record was ingested during the batch processing run.
ConfigID	integer	Unique identifier of the configuration associated with this member record.

AWSGuardDutyNetworkInterfaces

Records network interface details associated with GuardDuty findings on EC2 instances, including IP addresses, subnet, VPC, and security group information.

Name	Type	Description
ConfigID	integer	Unique identifier of the configuration associated with this network interface record.
ID	integer	Auto-incremented primary key for the network interface row.
FindingID	string	Identifier of the GuardDuty finding associated with this network interface.
NetworkInterfaceID	string	AWS identifier of the EC2 network interface (e.g., `eni-0abc123456789def0`).
PrivateDnsName	string	Private DNS hostname assigned to the network interface within the VPC.
PrivateIpAddress	string	Primary private IPv4 address of the network interface.
PublicDnsName	string	Public DNS hostname assigned to the network interface, if publicly accessible.
PublicIP	string	Public IPv4 address associated with the network interface, if assigned.
SubnetID	string	ID of the subnet in which the network interface is located.
VPCID	string	ID of the VPC in which the network interface resides.
IPv6AddressesSerialized	string	Serialized list of IPv6 addresses assigned to the network interface.
PrivateIpAddressesSerialized	string	Serialized list of all private IPv4 addresses associated with the network interface.
SecurityGroupsSerialized	string	Serialized list of security groups attached to the network interface.
AWSGuardDutyFindingsModelConfigID	integer	Foreign key referencing the ConfigID of the parent AWSGuardDutyFindings record.
AWSGuardDutyFindingsModelFindingID	string	Foreign key referencing the FindingID of the parent AWSGuardDutyFindings record.
BatchDate	datetime	Timestamp when this record was ingested during the batch processing run.

AWSGuardDutyPortProbeDetails

Contains details of port probe events detected by GuardDuty, including local and remote IP addresses, port numbers, and geolocation data.

Name	Type	Description
ConfigID	integer	Unique identifier of the configuration associated with this port probe detail record.
ID	integer	Auto-incremented primary key for the port probe detail row.
FindingID	string	Identifier of the GuardDuty finding associated with this port probe.
LocalIPAddressV4	string	Local IPv4 address of the resource that was probed.
LocalIPAddressV6	string	Local IPv6 address of the resource that was probed, if applicable.
LocalPort	integer	Port number on the local resource that was probed.
LocalPortName	string	Common name of the local port that was probed (e.g., `SSH`, `RDP`, `HTTP`).
RemoteIPAddressV4	string	IPv4 address of the remote host that performed the port probe.
RemoteIPAddressV6	string	IPv6 address of the remote host that performed the port probe, if applicable.
RemoteIPCity	string	City associated with the geolocation of the remote IP that performed the probe.
RemoteIPCountryName	string	Full country name associated with the geolocation of the remote IP.
RemoteIPCountryCode	string	ISO country code of the remote IP that performed the probe (e.g., `US`, `CN`).

AWSGuardDutyProcessLineage

Stores the lineage chain of processes involved in GuardDuty runtime monitoring findings, enabling parent-child process relationship analysis.

Name	Type	Description
ConfigID	integer	Unique identifier of the configuration associated with this process lineage record.
ID	integer	Auto-incremented primary key for the process lineage row.
FindingID	string	Identifier of the GuardDuty finding associated with this process lineage.
Name	string	Name of the process in the lineage chain.
PID	integer	Host-level process ID (PID) of the process.
NamespacePID	integer	PID of the process within its Linux PID namespace (used in container contexts).
EUID	integer	Effective user ID (EUID) under which the process was running.
ExecutablePath	string	File system path of the executable that launched this process.
ParentUUID	string	UUID of the parent process in the lineage chain.
UUID	string	Unique identifier (UUID) assigned to this process.
StartTime	datetime	Timestamp when this process started.
UserID	integer	User ID (UID) of the user who owns the process.
AWSGuardDutyFindingsModelConfigID	integer	Foreign key referencing the ConfigID of the parent AWSGuardDutyFindings record.
AWSGuardDutyFindingsModelFindingID	string	Foreign key referencing the FindingID of the parent AWSGuardDutyFindings record.
BatchDate	datetime	Timestamp when this record was ingested during the batch processing run.

AWSGuardDutyRDSLoginAttributes

Records RDS database login attempt attributes associated with GuardDuty findings, including username, application, and counts of successful and failed attempts.

Name	Type	Description
ConfigID	integer	Unique identifier of the configuration associated with this RDS login attribute record.
ID	integer	Auto-incremented primary key for the RDS login attribute row.
FindingID	string	Identifier of the GuardDuty finding associated with these RDS login attributes.
Application	string	Application name used during the RDS database login attempt.
User	string	Database username used in the RDS login attempt.
FailedLoginAttempts	integer	Number of failed login attempts observed for this user against the RDS instance.
SuccessfulLoginAttempts	integer	Number of successful login attempts observed for this user against the RDS instance.
AWSGuardDutyFindingsModelConfigID	integer	Foreign key referencing the ConfigID of the parent AWSGuardDutyFindings record.
AWSGuardDutyFindingsModelFindingID	string	Foreign key referencing the FindingID of the parent AWSGuardDutyFindings record.
BatchDate	datetime	Timestamp when this record was ingested during the batch processing run.

AWSGuardDutyS3BucketDetails

Contains S3 bucket metadata associated with GuardDuty findings, including ARN, owner, encryption settings, public access permissions, and object details.

Name	Type	Description
ConfigID	integer	Unique identifier of the configuration associated with this S3 bucket detail record.
ID	integer	Auto-incremented primary key for the S3 bucket detail row.
FindingID	string	Identifier of the GuardDuty finding associated with this S3 bucket.
ARN	string	ARN of the S3 bucket involved in the finding.
Name	string	Name of the S3 bucket involved in the finding.
Type	string	Role of the S3 bucket in the finding (e.g., `Destination`, `Source`).
CreatedAt	datetime	Timestamp when the S3 bucket was created.
OwnerID	string	Canonical user ID of the AWS account that owns the S3 bucket.
EncryptionType	string	Encryption type applied to the S3 bucket (e.g., `AES256`, `aws:kms`).
EncryptionKmsKeyARN	string	ARN of the KMS key used for S3 bucket encryption, if applicable.
PublicAccessEffectivePermission	string	Effective public access permission of the bucket (e.g., `PUBLIC`, `NOT_PUBLIC`).
S3ObjectDetailsSerialized	string	Serialized details of S3 objects involved in the finding.
TagsSerialized	string	Serialized key-value tags associated with the S3 bucket.
AWSGuardDutyFindingsModelConfigID	integer	Foreign key referencing the ConfigID of the parent AWSGuardDutyFindings record.
AWSGuardDutyFindingsModelFindingID	string	Foreign key referencing the FindingID of the parent AWSGuardDutyFindings record.
BatchDate	datetime	Timestamp when this record was ingested during the batch processing run.

AWSGuardDutyThreatIntelligence

Stores threat intelligence matches associated with GuardDuty findings, linking finding IDs to threat list names and file hashes.

Name	Type	Description
ConfigID	integer	Unique identifier of the configuration associated with this threat intelligence record.
ID	integer	Auto-incremented primary key for the threat intelligence row.
FindingID	string	Identifier of the GuardDuty finding associated with this threat intelligence detail.
ThreatListName	string	Name of the threat intelligence list that flagged the IP or domain (e.g., `ProofPoint`).
ThreatFileSHA256	string	SHA-256 hash of the threat file matched against the threat intelligence list.
ThreatNamesSerialized	string	Serialized list of threat names matched for this finding.
AWSGuardDutyFindingsModelConfigID	integer	Foreign key referencing the ConfigID of the parent AWSGuardDutyFindings record.
AWSGuardDutyFindingsModelFindingID	string	Foreign key referencing the FindingID of the parent AWSGuardDutyFindings record.
BatchDate	datetime	Timestamp when this record was ingested during the batch processing run.