27 Integrations with Amazon GuardDuty
View a list of Amazon GuardDuty integrations and software that integrates with Amazon GuardDuty below. Compare the best Amazon GuardDuty integrations as well as features, ratings, user reviews, and pricing of software that integrates with Amazon GuardDuty. Here are the current Amazon GuardDuty integrations in 2026:
-
1
Amazon S3
Amazon
Amazon Simple Storage Service (Amazon S3) is an object storage service that offers industry-leading scalability, data availability, security, and performance. This means customers of all sizes and industries can use it to store and protect any amount of data for a range of use cases, such as data lakes, websites, mobile applications, backup and restore, archive, enterprise applications, IoT devices, and big data analytics. Amazon S3 provides easy-to-use management features so you can organize your data and configure finely-tuned access controls to meet your specific business, organizational, and compliance requirements. Amazon S3 is designed for 99.999999999% (11 9's) of durability, and stores data for millions of applications for companies all around the world. Scale your storage resources up and down to meet fluctuating demands, without upfront investments or resource procurement cycles. Amazon S3 is designed for 99.999999999% (11 9’s) of data durability. -
2
Amazon CloudWatch
Amazon
Amazon CloudWatch is a monitoring and observability service built for DevOps engineers, developers, site reliability engineers (SREs), and IT managers. CloudWatch provides you with data and actionable insights to monitor your applications, respond to system-wide performance changes, optimize resource utilization, and get a unified view of operational health. CloudWatch collects monitoring and operational data in the form of logs, metrics, and events, providing you with a unified view of AWS resources, applications, and services that run on AWS and on-premises servers. You can use CloudWatch to detect anomalous behavior in your environments, set alarms, visualize logs and metrics side by side, take automated actions, troubleshoot issues, and discover insights to keep your applications. CloudWatch alarms watch your metric values against thresholds that you specify or that it creates using ML models to detect anomalous behavior. -
3
Bitcanopy
Bitcanopy
Automated AWS security. Hands-off AWS infrastructure insights and remediation. Ensure AWS Config is enabled in all regions. Identify and stop S3 public read/write/full control. Automatically enforce S3 objects and volumes encryption. Stop login from invalid IP address. Stop non-compliant dev resources. Delete unused elastic load balancers. Automatically apply IP restriction policy on AWS resources. Delete new internet-facing ELBs. Only keep certain port open based on pre-defined policy. RDS - Terminate unencrypted public instances. Monitor and remediate your infrastructure agains 100+ such rules that include compliance against AWS CIS benchmarks and AWS Best Practices.Starting Price: $75 per month -
4
AWS App Mesh
Amazon Web Services
AWS App Mesh is a service mesh that provides application-level networking to facilitate communication between your services across various types of computing infrastructure. App Mesh offers comprehensive visibility and high availability for your applications. Modern applications are generally made up of multiple services. Each service can be developed using various types of compute infrastructure, such as Amazon EC2, Amazon ECS, Amazon EKS, and AWS Fargate. As the number of services within an application grows, it becomes difficult to pinpoint the exact location of errors, redirect traffic after errors, and safely implement code changes. Previously, this required creating monitoring and control logic directly in your code and redeploying your services every time there were changes.Starting Price: Free -
5
Zenduty
Zenduty
Zenduty’s end-to-end incident alerting, on-call management and response orchestration platform helps you institutionalize reliability into your production operations. Get a single pane of glass view of the health of all your production operations. Respond to incidents 90% faster and resolve them 60% faster. Deploy customized and data-driven on-call rotations to ensure 24/7 operational coverage for major incidents. Deploy industry-leading incident response procedures and resolve incidents faster through effective task delegation and collaborative triaging. Bring your playbooks automatically into your incidents. Log incident tasks and action items for productive postmortems and future incidents. Suppress noisy alerts so that your engineers and support staff are focused on the alerts that matter. Over 100+ integrations with all your APMs, log monitoring, error monitoring, server monitoring, ITSM, Support, and security services.Starting Price: $5 per month -
6
Parny
Parny
Get AI recommendations for your alerts. It can generate recommendations for your alert based on the persona selected. Ask Parny AI has three personas, DevOps engineer, senior developer and database administrator. Our personas are trained to provide the best recommendations for your alerts. You can easily add your team members to the on-call team member list. Always alert the right person at the right time. Share on-call responsibility across your team with on-call schedules and automatic escalations. We support engineering teams to be more proactive, resolve incidents faster and deliver a seamless operations experience. Get custom analytics for your organization, teams, services and users. Always be up to date with your performance and improve your organization's efficiency.Starting Price: $7 per month -
7
Alert Logic
Fortra
Alert Logic is the only managed detection and response (MDR) provider that delivers comprehensive coverage for public clouds, SaaS, on-premises, and hybrid environments. Since no level of investment prevents or blocks 100% of attacks, you need to continuously identify and address breaches or gaps before they cause real damage. With limited expertise and a cloudcentric strategy, this level of security can seem out of reach. Our cloud-native technology and white-glove team of security experts protect your organization 24/7 and ensure you have the most effective response to resolve whatever threats may come. Founded in 2002, Alert Logic is headquartered in Houston, Texas and has business operations, team members, and channel partners located worldwide. Learn more at alertlogic.com. Alert Logic – unrivaled security for your cloud journey. -
8
Amazon Detective
Amazon
Analyze and visualize security data to rapidly get to the root cause of potential security issues. Amazon Detective makes it easy to analyze, investigate, and quickly identify the root cause of potential security issues or suspicious activities. Amazon Detective automatically collects log data from your AWS resources and uses machine learning, statistical analysis, and graph theory to build a linked set of data that enables you to easily conduct faster and more efficient security investigations. AWS security services like Amazon GuardDuty, Amazon Macie, and AWS Security Hub as well as partner security products can be used to identify potential security issues, or findings. These services are really helpful in alerting you when something is wrong and pointing out where to go to fix it. But sometimes there might be a security finding where you need to dig a lot deeper and analyze more information to isolate the root cause and take action. -
9
Sophos Cloud Optix
Sophos
Asset and network traffic visibility for AWS, Azure, and Google Cloud. Risk-based prioritization of security issues with guided remediation. Optimize spend for multiple cloud services on a single screen. Get automatic identification and risk-profiling of security and compliance risks, with contextual alerts grouping affected resources, detailed remediation steps, and guided response. Track cloud services side by side on a single screen for improved visibility, receive independent recommendations to reduce spend, and identify indicators of compromise. Automate compliance assessments, save weeks of effort mapping Control IDs from overarching compliance tools to Cloud Optix, and produce audit-ready reports instantly. Seamlessly integrate security and compliance checks at any stage of the development pipeline to detect misconfigurations and embedded secrets, passwords, and keys. -
10
AWS GovCloud
Amazon
Amazon's Regions designed to host sensitive data, regulated workloads, and address the most stringent U.S. government security and compliance requirements. AWS GovCloud (US) gives government customers and their partners the flexibility to architect secure cloud solutions that comply with the FedRAMP High baseline; the DOJ’s Criminal Justice Information Systems (CJIS) Security Policy; U.S. International Traffic in Arms Regulations (ITAR); Export Administration Regulations (EAR); Department of Defense (DoD) Cloud Computing Security Requirements Guide (SRG) for Impact Levels 2, 4 and 5; FIPS 140-2; IRS-1075; and other compliance regimes. AWS GovCloud (US-East) and (US-West) Regions are operated by employees who are U.S. citizens on U.S. soil. AWS GovCloud (US) is only accessible to U.S. entities and root account holders who pass a screening process. AWS GovCloud (US) Regions can help customers address compliance at every stage of their cloud journey.Starting Price: $0.02 per GB -
11
FortiCNP
Fortinet
FortiCNP, Fortinet’s Cloud-Native Protection product, helps security teams prioritize risk management activities based on a broad set of security findings from their cloud environments. Beyond the built-in CSPM and data scanning capabilities, FortiCNP collects information from cloud-native security services that provide vulnerability scanning, permissions analysis, and threat detection. Based on the information it collects, FortiCNP calculates an aggregate risk score for cloud resources, so customers can then manage risk management work based on the insights that this solution produces. Unlike traditional CSPM and CWPP products, FortiCNP provides deep security visibility with zero permissions across cloud infrastructures and helps prioritize security workflows for effective risk management.Starting Price: $360 per month -
12
Klera
Klera
Klera is a software products and services company focused on creating solutions that deliver intelligence from data, unlike ever before. We enable transparent, collaborative, and connected enterprises, without data silos. Our rapid, no code, intelligent application development platform simplifies how you gather, analyze, and synchronize data.Starting Price: $900 per month -
13
Abstract Security
Abstract Security
Put your team’s focus back on catching attackers and let Abstract handle the heavy lifting of security data management. Our real-time streaming approach gives the breathing room to prioritize their security effectiveness instead. No Noise – Remove unnecessary noise from your data in flight before routing it to your destination No lock-in – With our real-time normalization of data to OCSF format, route to any destination without worrying No Hassle – No need to learn complex query languages with our easy to use ‘no-code-required' model for policy creation. Additionally, let our AI SME help build your policies via natural language requests. No Alert Fatigue – Our AI SME can help summarize insights and prioritize alerts based on MITRE ATT&CK Framework. -
14
AWS CloudTrail
Amazon
AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. With CloudTrail, you can log, continuously monitor, and retain account activity related to actions across your AWS infrastructure. CloudTrail provides event history of your AWS account activity, including actions taken through the AWS Management Console, AWS SDKs, command line tools, and other AWS services. This event history simplifies security analysis, resource change tracking, and troubleshooting. In addition, you can use CloudTrail to detect unusual activity in your AWS accounts. These capabilities help simplify operational analysis and troubleshooting. Detect unauthorized access using the Who, What, and When information in CloudTrail Events. Respond with rules-based EventBridge alerts and automated workflows. Continuously monitor API usage history using machine learning (ML) models to spot unusual activity in your AWS accounts, and determine root cause. -
15
AWS Lambda
Amazon
Run code without thinking about servers. Pay only for the compute time you consume. AWS Lambda lets you run code without provisioning or managing servers. You pay only for the compute time you consume. With Lambda, you can run code for virtually any type of application or backend service - all with zero administration. Just upload your code and Lambda takes care of everything required to run and scale your code with high availability. You can set up your code to automatically trigger from other AWS services or call it directly from any web or mobile app. AWS Lambda automatically runs your code without requiring you to provision or manage servers. Just write the code and upload it to Lambda. AWS Lambda automatically scales your application by running code in response to each trigger. Your code runs in parallel and processes each trigger individually, scaling precisely with the size of the workload. -
16
AWS Security Hub
Amazon
Centrally view and manage security alerts and automate security checks. AWS Security Hub gives you a comprehensive view of your security alerts and security posture across your AWS accounts. There are a range of powerful security tools at your disposal, from firewalls and endpoint protection to vulnerability and compliance scanners. But oftentimes this leaves your team switching back-and-forth between these tools to deal with hundreds, and sometimes thousands, of security alerts every day. With Security Hub, you now have a single place that aggregates, organizes, and prioritizes your security alerts, or findings, from multiple AWS services, such as Amazon GuardDuty, Amazon Inspector, Amazon Macie, AWS Identity and Access Management (IAM) Access Analyzer, and AWS Firewall Manager, as well as from AWS Partner solutions. AWS Security Hub continuously monitors your environment using automated security checks based on the AWS best practices and industry standards. -
17
Stacklet
Stacklet
Stacklet builds on the Cloud Custodian project to offer an out-of-the-box solution with powerful management capabilities and advanced features to help businesses realize value. Stacklet is built by the original developer and maintainer of Cloud Custodian. Cloud Custodian is used by thousands of well-known global brands today. The project’s community has hundreds of active contributors including Amazon, Microsoft and Capital One and is growing rapidly. Stacklet provides a best-of-breed solution for cloud governance addressing needs around Security, Cost Optimization and Regulatory Compliance. Tooling to manage Cloud Custodian at scale across thousands of cloud accounts, policies and regions. Access to best practice policy sets which solve business problems out-of-the-box. Data and visualizations to understand policy health, resource auditing, trends and anomalies. Real-time inventory, historical revisions and change management of cloud assets. -
18
TruSTAR
TruSTAR
TruSTAR's cloud-native Intelligence Management platform transforms intelligence from third-party providers and historical events for seamless integration and accelerated automation across core detection, orchestration and response tools. TruSTAR transforms your intelligence for seamless integration and actionable automation across your ecosystem of teams and tools. TruSTAR is platform agnostic. Get investigation context and enrichment inside your mission-critical security tools. Our Open API enables you to connect to any application, anytime. Automate detection, triage, investigation, and dissemination workflows from a single endpoint. Managing intelligence in enterprise security is about managing data to drive automation. TruSTAR normalizes and prepares intelligence for orchestration, significantly reducing playbook complexity. Spend less time wrangling data, and more time catching bad guys. The TruSTAR platform has been designed to provide maximum flexibility. -
19
Gurucul
Gurucul
Data science driven security controls to automate advanced threat detection, remediation and response. Gurucul’s Unified Security and Risk Analytics platform answers the question: Is anomalous behavior risky? This is our competitive advantage and why we’re different than everyone else in this space. We don’t waste your time with alerts on anomalous activity that isn’t risky. We use context to determine whether behavior is risky. Context is critical. Telling you what’s happening is not helpful. Telling you when something bad is happening is the Gurucul difference. That’s information you can act on. We put your data to work. We are the only security analytics company that can consume all your data out-of-the-box. We can ingest data from any source – SIEMs, CRMs, electronic medical records, identity and access management systems, end points – you name it, we ingest it into our enterprise risk engine. -
20
Cybraics
Cybraics
Stop chasing alerts and prevent incidents before they happen with the world's leading XDR platform that revolutionizes threat detection, log management, and response. Close the gaps and free your team with our silo-breaking, enterprise-class industry-leading XDR platform that covers compliance and simplifies security operations. Cybraics nLighten™ isn't just another security tool. Born out of AI and machine learning research with the U.S. Department of Defense, it's the catalyst to unlock actionable intelligence from the scattered and siloed data, logs, and alerts across multiple security tools in your network. And with Cybraics, powerful threat detection doesn't need to come at a premium. Powered by Adaptive Analytic Detection (AAD) and Persistent Behavior Tracing (PBT). Maximize security team efficacy with 96% automated actionable case creation and a 95% reduction in false positives. Reduce detection and response time from months to minutes. -
21
Sekoia.io
Sekoia.io
Sekoia.io’s new take reinvents traditional cybersecurity solutions. Anticipation through attacker knowledge is natively associated with the automation capabilities of detection and response to attacks. Sekoia.io gives back the advantage to cyber teams to face attackers. With Sekoia.io SOC platform, detect computer attacks, neutralize their impacts and protect your information system effectively, in real time and 360 degrees. Sekoia.io natively integrates attacker intelligence flows and automation capabilities to identify, understand and neutralize attacks quicker. This innovative approach gives teams time to focus on high value-added tasks. Sekoia.io covers your different environments to remove complexity and natively provides detection capabilities that do not depend on knowledge of the system to be protected. -
22
Revelstoke
Revelstoke
Rock your SOC with the first universal, low-code, high-speed security automation platform with case management built in. Revelstoke uses a single, universal data model that normalizes input and output data to allow for fast integration of any security product, and it’s future-proof. Our UI is based on the Kanban-style workflow. Grab a card, drag it into place, drop it where you want, and boom, the automation works. You can track and monitor case actions, timeline information, and workflow actions, all from the case management dashboard. IR is at your fingertips. Measure and report on the business impact of security automation, prove the value of the investment and show what your team is worth. Revelstoke radically simplifies security orchestration, automation, and response (SOAR), so security teams can work faster, smarter, and more effectively. With a low-code, drag-and-drop interface, dozens of built-in integrations, and incredible visibility into performance metrics. -
23
Learn what a digital risk protection solution is and how it can help you be better prepared by understanding who is targeting you, what they’re after, and how they plan to compromise you. Google Digital Risk Protection delivers a broad digital risk protection solution either via stand-alone self-managed SaaS products or a comprehensive service. Both options give security professionals visibility outside their organization, the ability to identify high-risk attack vectors, malicious orchestration from the deep and dark web, and attack campaigns on the open web. The Google Digital Risk Protection solution also provides contextual information on threat actors and their tactics, techniques, and procedures to provide a more secure cyber threat profile. Gain visibility into risk factors impacting the extended enterprise and supply chain by mapping your attack surface and monitoring deep and dark web activity.
-
24
Daylight
Daylight
Daylight merges lightning-fast agentic AI with elite human expertise to deliver a next-gen managed detection and response service that goes beyond alerts, aiming to “take command” of your cyber-frontier. It promises full coverage of your environment with no blind spots, context-aware protection that continuously learns from your systems and past cases (including Slack chats), near-zero false positives, the industry’s lowest mean time to detection and mean time to response, and deep integration with your IT and security stack so it supports unlimited platforms, unlimited integrations, and delivers actionable, noise-free insights via AI dashboards. With Daylight, you get true end-to-end threat detection and response (no escalation games), 24/7 expert support, custom response workflows, environment-wide visibility, and measurable improvements in analyst utilization and response speed, all built to shift your security operations from reactive to commanding. -
25
Complyance
Complyance
Complyance is an AI-powered GRC platform designed for enterprise teams to centralize, automate, and manage their compliance, risk, vendor, and policy workloads. Its modular system includes out-of-the-box and fully customizable controls, a vendor management suite, risk registers, and a policy center. With hundreds of integrations into existing enterprise tools, Complyance automatically collects and maps evidence, continuously monitors controls and vendor risk, and keeps your compliance posture audit-ready. Built-in AI features (and optional specialized AI Agents) auto-draft policy documents, cross-map evidence to controls, score vendor risk, generate client questionnaire responses, and surface compliance gaps, cutting manual work by up to 70–90%. The AI operates in a privacy-first way; each client has an isolated instance, and no data is used to train shared models. -
26
7AI
7AI
7AI is an agentic security platform built to automate and accelerate the entire security operations lifecycle using specialized AI agents that investigate security alerts, form conclusions, and take action, turning processes that once took hours into minutes. Unlike traditional automation tools or AI copilots, 7AI deploys purpose-built, context-aware agents that are architecturally bounded to avoid hallucinations, and operate autonomously; they ingest alerts from existing security tools, enrich and correlate data across endpoints, cloud, identity, email, network, and more, and then produce full investigations with evidence, narrative summaries, cross-alert correlation, and audit trails. It offers a complete security stack: detection to triage alerts (filtering out noise and up to 95–99% of false positives), investigations (multi-system data-gathering and expert-level reasoning), and unified incident-case management (auto-populated cases, team collaboration, and handoffs). -
27
Chronicle SOAR
Chronicle
Employ playbooks for fast time-to-value and ease of scaling as you grow. Address common day-to-day challenges (phishing or ransomware) with ready to run use cases, complete with playbooks, simulated alerts and tutorials. Create playbooks that orchestrate hundreds of the tools you rely on with simple drag and drop. Plus, automate repetitive tasks to respond faster and free up time for higher value work. Maintain, optimize, troubleshoot, and iterate playbooks with lifecycle management capabilities including run analytics, reusable playbook blocks, version control, and rollback. Integrate threat intelligence at every step and visualize the most important contextual data for each threat – who did what, and when – and the relationships between all involved entities attached to an event, product, or source. Patented technology automatically groups contextually related alerts into a single threat-centric case, enabling a single analyst to efficiently investigate and respond to a threat.
- Previous
- You're on page 1
- Next
