diff --git a/docs/integrations/amazon-aws/guardduty.md b/docs/integrations/amazon-aws/guardduty.md
index 1b2c99f3b3c..4ac75fbecb2 100644
--- a/docs/integrations/amazon-aws/guardduty.md
+++ b/docs/integrations/amazon-aws/guardduty.md
@@ -262,7 +262,7 @@ In this step, you deploy the events processor. This will create the AWS resource
* `SOURCE_NAME_OVERRIDE` (optional). Override `_sourceName` value configured for the HTTP source.
-## Installing the Amazon GuardDuty App
+## Installing the Amazon GuardDuty app
Now that you have set up collection for Amazon GuardDuty, install the Sumo Logic App to use the pre-configured searches and dashboards that provide visibility into your environment for real-time analysis of overall usage.
@@ -280,7 +280,7 @@ import ViewDashboards from '../../reuse/apps/view-dashboards.md';
See the overview of GuardDuty threats including the severity, threat purpose, resource type, threat name, account ID, and region.
-})
+})
**GuardDuty Threat Map**. See the count of threats on a world map in the last 24 hours.
@@ -302,7 +302,7 @@ See the overview of GuardDuty threats including the severity, threat purpose, re
See the details of GuardDuty CloudTrail threats including the count, title, the trend, and action type.
-})
+})
**CloudTrail Threats.** See the count of CloudTrail threats in the last 24 hours.
@@ -318,7 +318,7 @@ See the details of GuardDuty CloudTrail threats including the count, title, the
See the GuardDuty threat details including the count, account-region trend, threat purpose, severity, resource type, and security group.
-})
+})
**Outliers - All Threats**. See the outliers in all threats in the last 24 hours on a line chart.
@@ -338,7 +338,7 @@ See the GuardDuty threat details including the count, account-region trend, thre
See the details of GuardDuty threats by VPC, security group, and subnet ID.
-})
+})
**Threat Type by VPC**. See the count of threat type by VPC in the last 24 hours displayed on a bar chart.
@@ -347,3 +347,30 @@ See the details of GuardDuty threats by VPC, security group, and subnet ID.
**Severity Count by SubnetID**. See the count of severity in the last 24 hours by Subnet ID on a bar chart.
**VPC, Subnet, and Security Group Threat Table.** See the details of severity in the last 24 hours including the account ID, severity, region, VPC ID, Subnet ID, security group name and ID, threat purpose, resource type, threat name, and count, displayed in a table.
+
+## Create monitors for Amazon GuardDuty app
+
+import CreateMonitors from '../../reuse/apps/create-monitors.md';
+
+
+
+### Amazon GuardDuty alerts
+
+| Name | Description | Alert Condition | Recover Condition |
+|:--|:--|:--|:--|
+| `Amazon GuardDuty - High Severity Threat Detected` | This alert is triggered when a high severity GuardDuty threat is detected. | Count > 0 | Count < = 0 |
+| `Amazon GuardDuty - CloudTrail Threat Detected` | This alert is triggered when a GuardDuty threat related to CloudTrail activity is detected. | Count > 0 | Count < = 0 |
+| `Amazon GuardDuty - IAMUser Threat Detected` | This alert is triggered when a GuardDuty threat targeting an IAM user resource is detected. | Count > 0 | Count < = 0 |
+| `Amazon GuardDuty - EC2 Instance Threat Burst` | This alert is triggered when a burst of GuardDuty threats targeting EC2 instances is detected. | Count > 5 | Count < = 5 |
+
+## Upgrade/Downgrade the Amazon GuardDuty app (Optional)
+
+import AppUpdate from '../../reuse/apps/app-update.md';
+
+
+
+## Uninstalling the Amazon GuardDuty app (Optional)
+
+import AppUninstall from '../../reuse/apps/app-uninstall.md';
+
+
diff --git a/static/img/integrations/amazon-aws/AWS_GuardDuty-Overview2.png b/static/img/integrations/amazon-aws/AWS_GuardDuty-Overview2.png
deleted file mode 100644
index e2f8a0a1bb3..00000000000
Binary files a/static/img/integrations/amazon-aws/AWS_GuardDuty-Overview2.png and /dev/null differ
diff --git a/static/img/integrations/amazon-aws/Amazon-GD-Details.png b/static/img/integrations/amazon-aws/Amazon-GD-Details.png
deleted file mode 100644
index 7d3fc70bec1..00000000000
Binary files a/static/img/integrations/amazon-aws/Amazon-GD-Details.png and /dev/null differ
diff --git a/static/img/integrations/amazon-aws/Amazon-GuardDuty-CloudTrail-Details.png b/static/img/integrations/amazon-aws/Amazon-GuardDuty-CloudTrail-Details.png
new file mode 100644
index 00000000000..9957c61eabc
Binary files /dev/null and b/static/img/integrations/amazon-aws/Amazon-GuardDuty-CloudTrail-Details.png differ
diff --git a/static/img/integrations/amazon-aws/Amazon-GuardDuty-Details.png b/static/img/integrations/amazon-aws/Amazon-GuardDuty-Details.png
new file mode 100644
index 00000000000..146b770d34b
Binary files /dev/null and b/static/img/integrations/amazon-aws/Amazon-GuardDuty-Details.png differ
diff --git a/static/img/integrations/amazon-aws/Amazon-GuardDuty-Overview.png b/static/img/integrations/amazon-aws/Amazon-GuardDuty-Overview.png
new file mode 100644
index 00000000000..65376f134c5
Binary files /dev/null and b/static/img/integrations/amazon-aws/Amazon-GuardDuty-Overview.png differ
diff --git a/static/img/integrations/amazon-aws/Amazon-GuardDuty-VPCs-Subnets-Security-Group-Details.png b/static/img/integrations/amazon-aws/Amazon-GuardDuty-VPCs-Subnets-Security-Group-Details.png
new file mode 100644
index 00000000000..629ac853d53
Binary files /dev/null and b/static/img/integrations/amazon-aws/Amazon-GuardDuty-VPCs-Subnets-Security-Group-Details.png differ
diff --git a/static/img/integrations/amazon-aws/CloudTrailDetails.png b/static/img/integrations/amazon-aws/CloudTrailDetails.png
deleted file mode 100644
index 426df52dabf..00000000000
Binary files a/static/img/integrations/amazon-aws/CloudTrailDetails.png and /dev/null differ
diff --git a/static/img/integrations/amazon-aws/VPCsSubnetsSecurityGroupDetails.png b/static/img/integrations/amazon-aws/VPCsSubnetsSecurityGroupDetails.png
deleted file mode 100644
index e37086d95f2..00000000000
Binary files a/static/img/integrations/amazon-aws/VPCsSubnetsSecurityGroupDetails.png and /dev/null differ