> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bronto.io/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS GuardDuty Findings

> Ingest AWS GuardDuty threat findings — alerts for compromised credentials, unusual API calls, and suspicious network activity.

AWS GuardDuty produces findings — threat-intelligence alerts covering compromised credentials, unusual API calls, reconnaissance activity, malware on EC2 and EKS workloads, and other security events.

## Recommended method

[**EventBridge API Destinations**](./aws-eventbridge) — GuardDuty publishes findings as EventBridge events, so a rule with an API Destination delivers them to Bronto in real time over HTTPS.

## Alternatives

* [**S3 Log Forwarder**](./aws-client-s3) — for environments that already export findings to an S3 bucket via the GuardDuty findings-export feature.

See [Ingesting AWS Data into Bronto](./aws-overview) for the full service-to-method mapping.

## References

* [AWS GuardDuty — exporting findings](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_exportfindings.html)