After a malware scan is initiated on an Amazon EC2 instance, GuardDuty provides the status and result fields automatically. You can monitor the status through transitions, and view if malware was detected. The following table provides the possible values associated to the malware scan.
| Category | Potential values |
|---|---|
|
Scan status |
|
|
Scan result* |
|
|
Scan type |
|
*Scan result is populated only when the scan status becomes Completed.
The scan result Infected means that GuardDuty detected the presence of malware.
Scan results for each malware scan has a retention period of 90 days. Choose your preferred access method to track the status of your malware scan.
Open the GuardDuty console at https://console.aws.amazon.com/guardduty/
. -
In the navigation pane, choose EC2 malware scans.
-
You can filter the malware scans by the following Properties available in the filter search bar.
-
Scan ID – Unique identifier associated with the EC2 malware scan.
-
Account ID – AWS account ID where the malware scan initiated.
-
EC2 instance ARN – Amazon Resource Name (ARN) associated with the Amazon EC2 instance associated with the scan.
-
Scan status – The scan status of the EBS volume, such as Running, Skipped, and Completed
-
Scan type – Indicates whether this was an On-demand malware scan or a GuardDuty-initiated malware scan.
-
