---
title: "Turn on threat detection in every account · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/identity-and-access/threat-detection
id: INF-15
level: Recommended
updated: 2026-10-22
build: a2a6bdfed830
tokens: 938
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Turn on threat detection in every account

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Identity and access](https://agentwranglers.se/playbook/infrastructure/identity-and-access.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: INF-15
- Level: Recommended
- Chapter: [Identity and access](https://agentwranglers.se/playbook/infrastructure/identity-and-access.md)
- Rule: Turn on the cloud's managed threat detection in every account and region you use. Send high and critical findings to the on-call team within 15 minutes.
- Check: Every account and region in use reports the detector as enabled. Create sample findings in a sandbox account, and the on-call alert arrives within 15 minutes.
- How: Use the provider's service, such as Amazon GuardDuty, Google Security Command Center or Microsoft Defender for Cloud. It reads the audit log, DNS queries and network flows, and flags stolen keys, crypto mining and calls from known bad addresses. Turn it on from the [account baseline](https://agentwranglers.se/playbook/infrastructure/environments/account-baseline.md) with one delegated admin account for the organization. Route findings by severity to the same pager as other alerts, as in the [operations playbook](https://agentwranglers.se/playbook/operations.md). Close or suppress each finding with a written reason. Route the findings as [Page only for what cannot wait](https://agentwranglers.se/playbook/operations/alerts-and-on-call/page-or-ticket.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Terraform example

```hcl
resource "aws_guardduty_detector" "baseline" {
  enable = true
}

resource "aws_cloudwatch_event_rule" "high_findings" {
  name = "guardduty-high-findings"
  event_pattern = jsonencode({
    source        = ["aws.guardduty"]
    "detail-type" = ["GuardDuty Finding"]
    detail        = { severity = [{ numeric = [">=", 7] }] }
  })
}
```

### Shell example

```sh
# Run in a sandbox account. The on-call alert must arrive within 15 minutes.
aws guardduty create-sample-findings --detector-id "$(aws guardduty list-detectors --query 'DetectorIds[0]' --output text)"
```

## Sources

- [Amazon GuardDuty Regions and endpoints](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_regions.html)

## Related rules

- INF-14 [Start every account from one baseline](https://agentwranglers.se/playbook/infrastructure/environments/account-baseline.md) in Infrastructure and environments
- OPS-20 [Page only for what cannot wait](https://agentwranglers.se/playbook/operations/alerts-and-on-call/page-or-ticket.md) in Operations and observability

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/infrastructure/identity-and-access/threat-detection">Agent Wranglers infrastructure and environments playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Name the caller in every trust you give a vendor or a service](https://agentwranglers.se/playbook/infrastructure/identity-and-access/confused-deputy-conditions.md)
- Next: [Keep one audit trail for the whole organization that no account can change](https://agentwranglers.se/playbook/infrastructure/identity-and-access/cloud-audit-trail.md)
- [Identity and access](https://agentwranglers.se/playbook/infrastructure/identity-and-access.md)