# GuardDuty Findings Calculator AI Agent Connect

> Project AWS GuardDuty finding volumes, detection source requirements, and resource overhead.

## Overview
- **Category:** security
- **Price:** Free
- **Endpoint:** https://edge.vinkius.com/vk_preview_NNZYcG73iikH6K8VNvwq3ReIp4uBIn5fOUpW31ze/ai-agent-connect
- **Tags:** guardduty, aws-security, cloud-governance, infrastructure, threat-detection

## Description

This MCP server provides deterministic calculations for AWS GuardDuty operations. Use `calculate_finding_projections` to estimate daily finding volumes and severity distributions based on event throughput. Use `calculate_infrastructure_requirements` to determine the breakdown of detection sources like CloudTrail and VPC Flow Logs, as well as resource overhead for EKS and ECS Fargate runtime monitoring. Finally, use `calculate_governance_recommendations` to get administrative guidelines for suppression rules, archive periods, and the number of administrators required for your account scale.

## Tools

### calculate_finding_projections
Estimates the total number of findings and their severity distribution based on event throughput

### calculate_governance_recommendations
Provides administrative guidelines for account management and finding lifecycle

### calculate_infrastructure_requirements
Determines the detection source breakdown and specific resource overhead for runtime monitoring

## Prompt Examples

**Prompt:** 
```
Estimate findings for 5 accounts with 500 events per second and S3/EKS enabled.
```

**Response:** 
```
The projected daily findings are 43,200, with a distribution of Info, Low, Medium, and High severities based on your enabled sources.
```

**Prompt:** 
```
What are the infrastructure requirements for 10 EKS nodes with Runtime monitoring enabled?
```

**Response:** 
```
The EKS agent will require 1000 MB of total memory (100 MB per node) for runtime monitoring.
```

**Prompt:** 
```
How many administrators do I need for 2500 AWS accounts?
```

**Response:** 
```
You will need 3 administrators to manage 2500 accounts based on the recommended threshold.
```

## Frequently Asked Questions

**How do I estimate my daily finding volume?**
You can use the `calculate_finding_projections` tool. Provide the total number of AWS accounts and the estimated average number of raw log events processed per second.

**Does runtime monitoring add resource overhead?**
Yes. For EKS, the `calculate_infrastructure_requirements` tool calculates a 100 MB memory overhead per node. For ECS Fargate, it flags the sidecar container overhead.

**What are the recommended governance settings?**
The `calculate_governance_recommendations` tool suggests up to 100 suppression rules and a 90-day archive period based on your account count.