Reports for Every Cloud
Purpose-built reports that answer the questions cloud and security teams actually ask — across AWS, Azure, and Google Cloud.
60
Curated Reports
2077+
Controls Checked
3
Cloud Providers
5 min
To First Results
Threat Detection Coverage
57 controls
25 services covered
Verifies threat detection coverage — GuardDuty and its S3, EC2 malware, runtime, EKS, Lambda, RDS, AI, and Backup protection plans, Inspector scanning for EC2, ECR, and Lambda, ECR scan on push, Macie sensitive data discovery, Security Hub standards, Amazon Detective behavior graph membership, Shield Advanced DDoS protection and automatic application layer mitigation, Security Lake CloudTrail log collection, SES malware scanning, and organization-wide auto-enrollment and delegated administration.
What we check
GuardDuty Runtime Protection6
- GuardDuty Runtime Protection Enabled
- GuardDuty Runtime Protection Auto-Enroll Accounts in the Organization
- GuardDuty Runtime Protection EC2 Automated Agent Configuration Enabled
- GuardDuty Runtime Protection EC2 Automated Agent Configuration Auto-Enroll Enabled in the Organization
- GuardDuty Runtime Protection ECS Fargate Automated Agent Configuration Enabled
- GuardDuty Runtime Protection ECS Fargate Automated Agent Configuration Auto-Enroll Enabled in the Organization
Security Hub Settings5
- AWS Security Hub is Enabled
- AWS Security Best Practices Monitoring Enabled
- PCI DSS v4.0.1 Compliance Monitoring Standard Enabled
- Security Hub AI Security Best Practices Enabled
- Security Hub Auto-Enable New Controls Configured
GuardDuty EKS Protection4
- GuardDuty EKS Audit Logs Protection Enabled
- GuardDuty EKS Audit Logs Protection Auto-Enroll Accounts in the Organization
- GuardDuty Runtime Protection EKS Automated Agent Configuration Enabled
- GuardDuty Runtime Protection EKS Automated Agent Configuration Auto-Enroll Enabled in the Organization
Security Hub Organization Settings4
- Security Hub Management is Delegated in the Organization
- Security Hub Auto-Enroll Accounts in the Organization
- Security Hub Findings Aggregated to Dedicated Security Account
- Security Hub Finding Cross-Region Aggregation is Configured
GuardDuty Organization Settings3
- GuardDuty Management is Delegated in the Organization
- GuardDuty Auto-Enroll Accounts in the Organization
- GuardDuty Security Findings are Aggregated to a Dedicated Account
Inspector EC2 Scanning3
- Inspector Scanning Enabled for EC2
- EC2 Instances Covered by Inspector Vulnerability Scanning
- Inspector EC2 Auto-Enroll Accounts in the Organization
Inspector ECR Scanning3
- Inspector Scanning Enabled for ECR
- ECR Repositories Covered by Inspector Vulnerability Scanning
- Inspector ECR Auto-Enroll Accounts in the Organization
Inspector Lambda Scanning3
- Amazon Inspector Lambda Standard Scanning is Enabled
- Inspector Lambda Code Scanning Enabled
- Lambda Functions Covered by Inspector Vulnerability Scanning
Macie Organization Settings3
- Macie Management is Delegated in the Organization
- Macie Auto-Enroll Accounts in the Organization
- Macie Findings are Aggregated to a Dedicated Account
GuardDuty S3 Protection2
- GuardDuty S3 Protection Enabled
- GuardDuty S3 Protection Auto-Enroll Accounts in the Organization
GuardDuty EC2 Malware Protection2
- GuardDuty EC2 Malware Protection Enabled
- GuardDuty EC2 Malware Protection Auto-Enroll Accounts in the Organization
GuardDuty Lambda Protection2
- GuardDuty Lambda Protection Enabled
- GuardDuty Lambda Protection Auto-Enroll Accounts in the Organization
GuardDuty RDS Protection2
- GuardDuty RDS Login Events Protection Enabled
- GuardDuty RDS Login Events Protection Auto-Enroll Accounts in the Organization
Inspector Organization Settings2
- Inspector Management is Delegated in the Organization
- Inspector Findings Aggregated to a Dedicated Security Account
Macie Settings2
- Amazon Macie Enabled
- Macie Automated Sensitive Data Discovery Should Be Enabled
Shield Advanced2
- Shield Advanced Automatic Application Layer DDoS Mitigation Enabled
- Shield Advanced Internet Facing Resources Protected
GuardDuty Settings1
- Amazon GuardDuty is Enabled
GuardDuty AI Protection1
- GuardDuty AI Protection Enabled Where AI Resources Exist
GuardDuty Malware Protection for AWS Backup1
- AWS Backup Automatic Malware Scanning Enabled
ECR Image Scanning1
- Image Scan on Push is Enabled
Macie S3 Bucket Monitoring1
- Amazon S3 Buckets Are Protected by Macie
SES Email Scanning1
- SES Malware and Spam Scanning Enabled
Security Lake Data Lakes1
- Security Lake CloudTrail Management Source Enabled
Detective Settings1
- Detective Behavior Graph Members Enabled
Detective Organization Settings1
- Detective Organization Auto Enable
Run these reports on your own cloud
Connect an account and get your first set of reports in minutes — free to start, no credit card required.