Query: GuardDuty runtime monitoring should be enabled

Description

This control checks whether runtime monitoring is enabled in Amazon GuardDuty. For a standalone account, the control fails if GuardDuty runtime monitoring is disabled for the account. In a multi-account environment, the control fails if GuardDuty runtime monitoring is disabled for the delegated GuardDuty administrator account and all member accounts.

Query

Tables used in this query:

• aws_guardduty_detector

Controls using this query:

• 11 GuardDuty Runtime Monitoring should be enabled
• GuardDuty runtime monitoring should be enabled

SQL