GuardDuty Findings Automation Template
Configuration
| Setting |
Value |
| Detector ID |
|
| Publishing Frequency |
15min / 1hr / 6hr |
| Multi-Account |
Yes / No |
| Security Hub Integration |
Enabled / Disabled |
EventBridge Rules
| Rule Name |
Severity Threshold |
Target |
Status |
| guardduty-critical |
>= 8.0 |
Lambda + PagerDuty |
|
| guardduty-high |
>= 7.0 |
Lambda + SNS |
|
| guardduty-medium |
>= 4.0 |
SNS |
|
Auto-Response Actions
| Finding Type |
Action |
Lambda Function |
Tested |
| EC2 Compromise |
Quarantine + Snapshot |
[ ] |
|
| IAM Credential |
Deactivate + Deny |
[ ] |
|
| S3 Exfiltration |
Block Public Access |
[ ] |
|
