Vendors / Amazon Web Services / AWS GuardDuty / GuardDuty RDS Protection Finding Types

Event type

GuardDuty RDS Protection Finding Types

Threat detection for Amazon RDS and Aurora databases

AWS GuardDuty RDS Protection finding types detecting anomalous login behavior, malicious IP access, and Tor network usage on Amazon Aurora, Amazon RDS, and Aurora Limitless databases through RDS login activity monitoring, including successful logins, failed logins, brute force attacks, and database probing

JSON 15 fields Medium Generator

rds database aurora credential-access threat-detection

Preview Sample View Schema

CLI Install

meltr templates install aws

Overview

What this event covers

RDS Protection detects anomalous login behavior on Amazon Aurora, Amazon RDS, and Aurora Limitless databases through RDS login activity monitoring. Uses ML anomaly detection and threat intelligence to identify suspicious database access patterns including anomalous logins, brute force attacks, malicious IP access, and Tor network usage.

When generated

›Anomalous successful login detected on RDS database (ML-detected)
›Anomalous failed login attempts detected on RDS database (ML-detected)
›Successful brute force login detected after pattern of failed attempts (ML-detected)
›Successful login from known malicious IP address
›Failed login attempt from known malicious IP address
›Malicious IP address probed RDS database (no login attempt)
›Successful login from Tor exit node IP address
›Failed login attempt from Tor exit node IP address
›Tor exit node probed RDS database (no login attempt)

Security relevance

Critical

Compliance

PCI-DSS 8.2, 10.2 HIPAA 164.308(a)(5), 164.312(b) SOC 2 CC6.1, CC6.6 ISO 27001 A.9.2, A.9.4 NIST CSF PR.AC-1, DE.CM-1 CIS AWS Foundations 4.1-4.16

Frequency notes

RDS Protection findings frequency depends on database access patterns and threat landscape. Production environments typically see 10-50 findings per day. Anomalous behavior findings use ML and require training period - frequency varies (5-30 per day). Malicious IP and Tor findings indicate active attacks (5-20 per day during attacks). Brute force findings are high-severity but lower frequency (1-10 per day). Discovery findings (probing without login) are medium-severity (5-15 per day).

Resources

Docs and tools

RDS Protection Finding Types official Remediating Potentially Compromised Database with Successful Login Events official Remediating Potentially Compromised Database with Failed Login Events official GuardDuty RDS Protection official RDS Login Activity-Based Anomalies official AWS GuardDuty Console Web interface for viewing and managing RDS Protection findings Amazon RDS Console Manage RDS database instances and clusters AWS Security Hub Centralized security findings including GuardDuty RDS findings

Generation

Configuration

Base frequency: 25 events/hour
Time patterns: business_hours night_hours weekend
Business hours: 2.5x
Night hours: 2.0x
Weekend: 1.0x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

detail.type

String Required

RDS Protection finding type indicating attack tactic and detection method

Source: random_choice() of 9 RDS Protection finding types

Example CredentialAccess:RDS/AnomalousBehavior.SuccessfulLogin

Values

CredentialAccess:RDS/AnomalousBehavior.SuccessfulLogin Anomalous successful login detected (severity: Variable - Low/Medium/High based on behavior)
CredentialAccess:RDS/AnomalousBehavior.FailedLogin Anomalous failed login attempts detected (severity: Low)
CredentialAccess:RDS/AnomalousBehavior.SuccessfulBruteForce Successful brute force login after pattern of failed attempts (severity: High)
CredentialAccess:RDS/MaliciousIPCaller.SuccessfulLogin Successful login from known malicious IP address (severity: High)
CredentialAccess:RDS/MaliciousIPCaller.FailedLogin Failed login attempt from known malicious IP address (severity: Medium)
Discovery:RDS/MaliciousIPCaller Malicious IP address probed database (no login attempt) (severity: Medium)
CredentialAccess:RDS/TorIPCaller.SuccessfulLogin Successful login from Tor exit node IP address (severity: High)
CredentialAccess:RDS/TorIPCaller.FailedLogin Failed login attempt from Tor exit node IP address (severity: Medium)
Discovery:RDS/TorIPCaller Tor exit node probed database (no login attempt) (severity: Medium)

detail.resource.resourceType

String Required

Type of RDS resource where activity was detected

Source: random_choice(['RDSDBInstance', 'RDSLimitlessDB'])

Example RDSDBInstance

Values

RDSDBInstance Amazon RDS or Aurora database instance
RDSLimitlessDB Aurora Limitless database

detail.resource.rdsDbInstanceDetails

Object Required

Details about the RDS database instance

Source: RDS instance metadata from GuardDuty

Example {dbInstanceIdentifier, engine, engineVersion, dbClusterIdentifier, dbInstanceArn, tags}

detail.resource.rdsDbInstanceDetails.engine

String Required

Database engine type

Source: random_choice() of supported RDS engines

Format Database engine identifier

Example aurora-mysql

Values

aurora-mysql Amazon Aurora MySQL
aurora-postgresql Amazon Aurora PostgreSQL
mysql MySQL
postgres PostgreSQL
mariadb MariaDB
oracle-ee Oracle Enterprise Edition
sqlserver-ee SQL Server Enterprise Edition

detail.service.action.rdsLoginActivity

Object Required

RDS login activity details that triggered the finding

Source: RDS login activity metadata from GuardDuty

Example {applicationProtocol, remoteIpDetails, localPortDetails, loginAttributes, blocked}

detail.service.action.rdsLoginActivity.applicationProtocol

String Required

Database protocol used for the connection

Source: random_choice(['mysql', 'postgresql', 'sqlserver', 'oracle'])

Format Protocol name

Example mysql

Values

mysql MySQL protocol
postgresql PostgreSQL protocol
sqlserver SQL Server protocol
oracle Oracle protocol

detail.service.action.rdsLoginActivity.loginAttributes.user

String Required

Database user that attempted or successfully logged in

Source: random_choice() from registry users or common database usernames

Format Username

Example admin

detail.service.action.rdsLoginActivity.loginAttributes.database

String Required

Database name that was accessed

Source: random_choice() of common database names

Format Database name

Example production

detail.service.action.rdsLoginActivity.loginAttributes.applicationName

String Optional

Application or client tool name used for the connection

Source: random_choice() of common database client tools

Format Application name

Example psql

detail.service.action.rdsLoginActivity.localPortDetails.port

Integer Required

Database port number

Source: random_choice([3306, 5432, 1433, 1521, 6379])

Format Integer (common database ports)

Example 3306

Values

3306 MySQL/MariaDB default port
5432 PostgreSQL default port
1433 SQL Server default port
1521 Oracle default port
6379 Redis default port

detail.service.action.rdsLoginActivity.remoteIpDetails.ipAddressV4

String Required

Source IP address of the database login attempt

Source: random_public_ip()

Format IPv4 address

Example 203.0.113.42

detail.service.action.rdsLoginActivity.blocked

Boolean Required

Whether the login attempt was blocked

Source: random_choice(['true', 'false'])

Format Boolean

Example false

detail.service.additionalInfo.unusual

Object Optional

ML model analysis of unusual behaviors for anomalous findings

Source: Object with unusual behavior flags for ML-detected anomalies

Example {"userIdentity": {"userName": "anomalous", "asnOrg": "not historical"}}

detail.service.additionalInfo.threatListName

String Optional

Name of threat intelligence list that matched (for malicious IP findings)

Source: random_choice() of threat intelligence list names

Format Threat list name

Example ProofPoint

detail.severity

Integer Required

Finding severity level (varies by finding type)

Source: random_choice([2, 2, 5, 5, 5, 8, 8]) - varies by finding type

Example 5

Values

2 Low severity (1.0-3.9) - e.g., AnomalousBehavior.FailedLogin, Discovery findings
5 Medium severity (4.0-6.9) - e.g., MaliciousIPCaller.FailedLogin, TorIPCaller.FailedLogin, Discovery findings
8 High severity (7.0-8.9) - e.g., AnomalousBehavior.SuccessfulBruteForce, MaliciousIPCaller.SuccessfulLogin, TorIPCaller.SuccessfulLogin