AWS bill line item
PaidEventsAnalyzed-Bytes
GuardDuty's charge for the volume (in GB) of network flow and DNS query log data it analyzes each month. A tiered per-GB schedule applies after any free-trial allowance.
GuardDuty log analysis, per GB
Verified against official AWS documentation last checked
Why it shows up
This scales with network traffic volume. It grows with egress, ingress, and DNS query volume. Busy NAT gateways, chatty microservices, and sudden traffic spikes all send more log data to GuardDuty for analysis.
New accounts and newly enabled detectors get a free trial period. The charge can jump sharply when the trial ends, even if traffic has not changed.
How to cut it
- Use GuardDuty's own usage statistics to identify which accounts or regions are contributing the most analyzed bytes.
- Reduce unnecessary network chatter feeding the underlying logs (tighten security groups, reduce noisy health-check or discovery traffic) rather than disabling the logs themselves.
- Take advantage of the built-in volume-tiered discount; consolidating accounts into an organization-wide setup can shift usage into cheaper tiers.
- Don't disable GuardDuty to save cost; instead confirm it's only enabled where needed, not duplicated across redundant member accounts.
How to read a usage type
PaidEventsAnalyzed-Bytes carries no region or direction token, so there's nothing to break down here.
Source
Source: AWS docs →Found PaidEventsAnalyzed-Bytes on your own bill?
Drop your Cost Explorer CSV into the AWS Bill Analyzer. It'll flag line items like this one on your own bill and link straight back to the fix.
Analyze your own bill →A bill read by hand goes stale tomorrow.
Reading one export line by line takes real work. CostMon reads the next one for you, every day, for every provider you connect.