Hands-on emulator lab · 6–10 min
Turn a threat alert into a careful investigation — GuardDuty
Generate a sample security finding and retrieve its investigation details.
These actions use an isolated AWS Emulator. It stores API state locally; it does not create paid cloud resources or run the full hosted AWS service.
Your goal
Generate a sample security finding and retrieve its investigation details.
Why this matters
A security finding needs careful reading before anyone reacts. You will generate a labeled sample and retrieve its details. The sample is training data and is not evidence of a real attack.
Words you will use
A finding is a reported security concern. A signal is evidence used to detect it. Triage means deciding how urgent an issue is and what to investigate first.
How to proceed
Start a fresh emulator, read each numbered step, and enter the practice settings shown. Run the action, inspect its API receipt, then continue. Finish lab checks the emulator state again before saving your progress.
1. Create a practice detector
Enable a GuardDuty detector in your emulator. This creates local API state; it does not monitor this website, your computer, or a real AWS account.
2. Generate a clearly marked sample
Ask the service to create a sample finding. It is training data, not evidence of an attack. Sample findings let you practice reading a report without causing harm.
3. Retrieve the sample details
List finding IDs, then request the details for those IDs. Inspect the type and resource information. A real investigation would seek supporting evidence before changing or deleting anything.
Practice, then check your understanding
Perform the actions yourself and inspect the returned state. Errors keep your settings so you can retry. Starting another lab clears the previous live environment. Earned XP is kept, and signed-in achievements sync to your account. Replay does not award duplicate XP.
Read the official AWS documentation for service behavior and production details.