mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-09-07 00:40:50 +03:00
24 lines
784 B
Markdown
24 lines
784 B
Markdown
# GuardDuty Findings Automation Template
|
|
|
|
## Configuration
|
|
| Setting | Value |
|
|
|---------|-------|
|
|
| Detector ID | |
|
|
| Publishing Frequency | 15min / 1hr / 6hr |
|
|
| Multi-Account | Yes / No |
|
|
| Security Hub Integration | Enabled / Disabled |
|
|
|
|
## EventBridge Rules
|
|
| Rule Name | Severity Threshold | Target | Status |
|
|
|-----------|-------------------|--------|--------|
|
|
| guardduty-critical | >= 8.0 | Lambda + PagerDuty | |
|
|
| guardduty-high | >= 7.0 | Lambda + SNS | |
|
|
| guardduty-medium | >= 4.0 | SNS | |
|
|
|
|
## Auto-Response Actions
|
|
| Finding Type | Action | Lambda Function | Tested |
|
|
|-------------|--------|----------------|--------|
|
|
| EC2 Compromise | Quarantine + Snapshot | [ ] | |
|
|
| IAM Credential | Deactivate + Deny | [ ] | |
|
|
| S3 Exfiltration | Block Public Access | [ ] | |
|