"I activated GuardDuty in my environment, but GuardDuty didn't generate any finding types"
I activated an Amazon GuardDuty account but I haven't received any finding types. How can I troubleshoot this?
"I activated an Amazon GuardDuty account but I haven't received any finding types. How can I troubleshoot this?Short descriptionActivating GuardDuty immediately begins to monitor for security threats. If GuardDuty discovers a security issue, then a finding type is generated. If GuardDuty doesn't detect security threats, then finding types aren't generated.ResolutionTo troubleshoot why GuardDuty hasn't generated any finding types, check the following configurations:The data sourcesThe GuardDuty statusThe trusted IP listsData sourcesGuardDuty uses its data sources to detect unauthorized and unexpected activity with resource types for some AWS services. The data sources include:AWS CloudTrail management event logs.Virtual Private Cloud (Amazon VPC) flow logs.DNS logs.CloudTrail data events for Amazon Simple Storage Service (Amazon S3)Kubernetes audit logAmazon Elastic Block Store (Amazon EBS) volume dataIt's a best practice to activate GuardDuty Kubernetes Protection, Amazon S3 protection, and Malware Protection which aren't activated by default.Note: GuardDuty only processes DNS logs if you use the default VPC DNS resolver. All other types of DNS resolvers won't generated DNS based findings.GuardDuty statusGuardDuty must be activated for finding types to generate. If GuardDuty is suspended or disabled, then no finding types are generated. It's a best practice to  activate GuardDuty in all supported AWS Regions. This allows GuardDuty to generate finding types for unauthorized or unusual activity even in Regions that you aren't actively using.Trusted IP listsYou can add IP addresses that you trust to communicate in your AWS environment to trusted IP lists. Trusted IP lists prevent GuardDuty from generating finding types for events that occurred from trusted IP addresses.It's a best practice to use a suppression rule instead of a trusted IP list to for awareness of detected issues in your environment. The suppression rule reduces the notifications from finding types. A suppression rule automatically archives new findings generated by GuardDuty that match specific criteria. You can review suppressed findings from the GuardDuty console by changing the Findings view dropdown menu from Current to Archived.To create GuardDuty findings for testing, do one of the following:Create sample findings from the GuardDuty console or API.Generate common GuardDuty findings automatically using the guardduty_tester.sh script.For more information, see How do I set up a trusted IP address list for GuardDuty?Related informationGetting started with GuardDutyWhy did GuardDuty send me alert findings for a trusted IP list address?Follow"