Security Specialty
GuardDuty vs Inspector vs Macie vs Security Hub vs Detective: Which AWS Security Service Does What?
GuardDuty detects threats, Inspector finds software vulnerabilities and network exposure, Macie finds sensitive data in S3, Security Hub CSPM aggregates findings and checks security standards, Detective investigates root cause, and Security Lake centralizes security data.
The six services in one table
| Service | What it does | What it looks at |
|---|---|---|
| Amazon GuardDuty | Threat detection. Continuously monitors, analyzes and processes AWS data sources and logs, using threat intelligence feeds and machine learning to find suspicious activity. | CloudTrail management events, VPC Flow Logs and Route 53 Resolver DNS logs by default, plus optional protections. |
| Amazon Inspector | Vulnerability management. Discovers workloads and continually scans them for software vulnerabilities and unintended network exposure. | Amazon EC2 instances, container images in Amazon ECR and Lambda functions. |
| Amazon Macie | Sensitive data discovery. Uses machine learning and pattern matching to find sensitive data, and evaluates the security of your buckets. | Amazon S3 buckets and objects. |
| AWS Security Hub CSPM | Posture management. Gives a comprehensive view of your security state and assesses it against standards such as AWS FSBP, CIS, PCI DSS and NIST. Also receives findings from other AWS services and partners. | Security data and findings across accounts and services. |
| Amazon Detective | Investigation. Helps you analyze, investigate and identify the root cause of security findings or suspicious activity. | Findings, finding groups and entities, for example from GuardDuty and Inspector. |
| Amazon Security Lake | Security data lake. Centralizes security data from AWS, SaaS, on-premises and third-party sources into a data lake in your account, in Parquet and the OCSF schema. | Log and event data from many sources. |
Source: docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html
Sources for each row: the "What is" pages for GuardDuty, Inspector, Macie, Security Hub CSPM, Detective and Security Lake.
Which one fits the scenario?
| Scenario | Service |
|---|---|
| Compromised or exfiltrated credentials, cryptomining or malware on EC2 or containers | GuardDuty |
| Find known software vulnerabilities in EC2 instances, ECR images or Lambda functions | Inspector |
| Find sensitive data such as personal information in S3, or a bucket that became public | Macie |
| See findings from many services in one place and check against CIS or PCI DSS | Security Hub CSPM |
| Work out which systems and users were affected and where an attack began | Detective |
| Keep security logs in a normalized data lake you own | Security Lake |
How they work together
- GuardDuty, Inspector and Macie generate findings.
- Security Hub CSPM collects findings from those services and checks your environment against security standards.
- Detective takes a finding and helps you triage, scope and find the root cause.
- Amazon EventBridge can route findings, for example from Macie, to Lambda or SNS to automate a response.
Study the detection side in GuardDuty, CloudTrail and Config notes and Macie notes. See Domain 1: Detection and Domain 2: Incident Response for the exam tasks.
Common confusions
- GuardDuty vs Inspector: GuardDuty looks for active threats and suspicious behavior; Inspector looks for vulnerabilities and unintended network exposure.
- Macie is about S3. It does not scan EC2 instances or databases for sensitive data.
- GuardDuty needs no extra setup for its core sources. It analyzes CloudTrail management events, VPC Flow Logs and DNS logs on its own, through independent streams.
- Security Hub CSPM does not replace the others. It aggregates and assesses; the specialized services produce many of the findings.
Frequently asked questions
What is the difference between GuardDuty and Inspector?
GuardDuty is threat detection that monitors logs and data sources for suspicious activity. Inspector is vulnerability management that scans EC2 instances, ECR container images and Lambda functions for software vulnerabilities and unintended network exposure.
Does GuardDuty require CloudTrail to be enabled?
No. GuardDuty consumes CloudTrail management events, VPC Flow Logs and Route 53 Resolver DNS logs through independent, duplicated streams.
What does CSPM stand for in Security Hub?
Cloud Security Posture Management.
Which service investigates the root cause of a finding?
Amazon Detective.
Sources
- What is Amazon GuardDuty? (AWS)
- What is Amazon Inspector? (AWS)
- What is Amazon Macie? (AWS)
- Introduction to AWS Security Hub CSPM (AWS)
- How Detective is used for investigation (AWS)
- What is Amazon Security Lake? (AWS)
AWS updates its programs and documentation. Check the linked official pages for the latest details before you decide or pay.
Practice for your AWS exam
Free practice tests with instant explanations and spaced repetition. No sign-up.
Keep reading
- Security Specialty
AWS WAF vs Shield vs Network Firewall vs Firewall Manager
Four AWS firewall-style services, four different jobs. See what WAF, Shield, Network Firewall and Firewall Manager protect and when to use each.
2 min read - Security Specialty
SCS-C03 In-Scope AWS Services: The Official List
Every AWS service on the Security Specialty exam, grouped by category, plus what is out of scope and the concepts AWS says to know.
2 min read - Security Specialty
AWS Security Specialty Study Plan: A 4-Week Roadmap
A week-by-week SCS-C03 study plan built from the domain weights: what to read, what to practice and how to finish with a timed test.
3 min read