In my monthly AWS account bill, GuardDuty shows that it analyzed around 1 million CloudTrail events in the month but when I downloaded the csv with all the events for the month, the row count is close to 400,000 only. And this is a repeating pattern across different regions and across many months.
Why is number of events analyzed by GuardDuty so high (in turn leading to higher costs)? Am I missing something?