Skip to main content

Threat Dashboard

The Threat Dashboard is the landing page for GuardDuty after setup completes. It shows a severity-based summary of all active (non-archived) findings across your enrolled accounts and regions, with drill-down links to the Findings page.

Accessing the Threat Dashboard​

In the Security Hub sidebar, click GuardDuty > Threats. If GuardDuty is enabled, you land directly on the Threat Dashboard.

The page header is titled Threat Dashboard, and its subtitle line shows:

  • Admin account: the delegated administrator account ID
  • Home region: the GuardDuty home region
  • Last refresh: how long ago the last successful findings refresh ran, as "just now", "5 min ago", "3 h ago", or "2 d ago"; shows "never" before the first successful refresh

Once a refresh you started (or one that was already running when you opened the page) completes, the subtitle also appends "N findings fetched" for that job. That count comes from the live job, so it disappears on the next page load; the Last refresh time is the part that persists.

Severity Cards​

Four severity cards summarize your non-archived finding counts. Each card shows an icon, the count, the severity name, and the caption "active threats" ("active threat" when the count is 1):

CardColorMeaning
CriticalRedCritical severity active findings
HighOrangeHigh severity active findings
MediumAmberMedium severity active findings
LowBlueLow severity active findings

Click any card to open the Findings page pre-filtered to that severity level.

Beneath the cards, a caption reads "Total active threats across critical, high, medium and low: N". N is the sum of the four cards above it — the caption names the four bands rather than claiming "all severities", because the summary the page reads also carries an INFORMATIONAL count that has no card.

info

Severity counts reflect non-archived findings only. Archived findings are excluded from all four cards. There is no INFORMATIONAL card: GuardDuty only assigns that band to a finding whose numeric severity is 0. See How the severity chip is derived for the numeric-to-band mapping.

Top Threat Types​

The Top threat types table lists the ten GuardDuty finding types with the most active findings, ordered by count, with the columns Type and Count. A chip in the card header reads "N types", and the card subtitle reads "Select a type to open the matching findings". If your organization has more than ten distinct finding types, the rest are not shown here; use the Findings page to see them.

Click any row to open the Findings page pre-filtered to that finding type.

If no threats have been detected since the last refresh, the table shows "No threat types detected yet — refresh findings to pull the latest from AWS."

Per-Account Threats​

The Per-account threats table lists every enrolled account that has at least one active threat, ordered by count, with the columns Account and Active threats. Unlike the threat-types table, this one is not capped. A chip in the card header reads "N accounts with threats", and the card subtitle reads "Select an account to open the matching findings".

Click any row to open the Findings page pre-filtered to that account.

If no accounts have active threats, the table shows "No accounts with active threats — every enrolled account is clear right now."

Refreshing Findings​

Prism does not pull GuardDuty findings in real time. You trigger a refresh to ingest the latest findings from AWS.

  1. Click Refresh findings in the top-right of the header.
  2. A progress bar appears below the header while the job runs, labelled with the region being scanned ("Scanning us-east-1…") and a percentage. Regions are scanned one at a time, in the order they were linked.
  3. When the job finishes, the severity cards and tables update automatically.

While a refresh is running the button is disabled and reads Refreshing…; its tooltip changes from "Fetch the latest findings from AWS" to "Refresh already in progress". Only one refresh job can run at a time.

If you navigate away or reload the page while a refresh is running, the dashboard re-attaches to the job in progress on load, so the progress bar picks up where it left off rather than starting over.

note

The refresh job ingests up to 50,000 active findings per run, counted across all linked regions rather than per region. Findings with a [SAMPLE] prefix in their title are GuardDuty sample findings generated by AWS for testing; they are ingested alongside real findings. Archived findings are not re-ingested during a refresh: the job asks AWS only for findings that are not archived.

When a Refresh Does Not Finish Cleanly​

A refresh has three outcomes, and the dashboard renders each one differently so a short or broken run never looks like a clean one.

OutcomeWhat you see
CleanThe progress bar disappears and the header appends "N findings fetched"
Finished with gapsAn amber banner above the cards: "Refresh finished with gaps: N findings fetched. The counts below cover only what was read." followed by the reason recorded on the job
FailedAn error panel above the cards showing the job's error, with a Retry action that starts a new refresh. If the job recorded no message, it reads "The findings refresh failed."

"Finished with gaps" is what a run that hit the 50,000-finding cap reports: everything up to the cap really was stored, so the job is a success, but the severity cards and tables below it cover only the part that was read. The recorded reason is "stopped at the N-finding cap; refine scope to capture the rest".

A failed run reports one message per failing region, as region: error. If a region also failed and the cap was hit, both facts are recorded in the same message — neither can be inferred from the other.

Partial Failure Banner​

Whenever the configuration is in the partial_failure state, a warning banner appears below the header reading "GuardDuty setup partially failed." followed by the error message recorded for the configuration. Click the Review button in the banner to open the Enrollment page, where you can see which accounts failed and retry them.

The banner's wording names setup, but the state it reports is not specific to setup: a partially-failed feature update, region change or disable raises the same banner. The message after the first sentence is the one that says which operation failed, so read that rather than the heading.