Question

A security engineer discovers that Amazon GuardDuty was intentionally disabled in the production account three weeks ago by a departing administrator, leaving a detection gap. The incident-response team needs to restore threat detection and, as part of recovery, retroactively understand what malicious activity may have occurred during the blind period without waiting weeks for new findings to accumulate. Which approach best supports both re-enabling detection and analyzing the historical gap?

Accepted Answer

Re-enable GuardDuty for ongoing detection, then use Amazon Detective and query the preserved CloudTrail, VPC Flow Logs, and DNS logs in CloudTrail Lake / Athena to reconstruct and investigate activity during the gap.

Answer

Re-enable GuardDuty and rely on its automatic backfill to reprocess VPC Flow Logs and CloudTrail from the past three weeks to generate retroactive findings.

Answer

Restore GuardDuty from a snapshot taken before it was disabled so that the previously generated findings and detection state are recovered.

Answer

Enable GuardDuty in a new dedicated security account and enable Malware Protection to scan existing EBS volumes for indicators from the past three weeks.