All 7 AWS Security Hub & GuardDuty questions
More in AWS Security Hub & GuardDuty
What is Amazon GuardDuty and how does it detect potential security threats within an AWS account? What is AWS Security Hub and how does it aggregate security findings from multiple sources? How does GuardDuty support monitoring for threats specific to Amazon S3, EKS, and RDS beyond general EC2 and account level threats? How can Security Hub's custom insights and automated response actions help security teams prioritize and manage findings more effectively at scale? How can an organization enable GuardDuty and Security Hub consistently across every account in an AWS Organization using delegated administration? How should a security team design an end to end incident response workflow that integrates GuardDuty, Security Hub, EventBridge, and Step Functions for both automated triage and human escalation?
Advertisement
Back to results for “Security”
AWS › AWS Security Hub & GuardDuty

How can GuardDuty findings be automatically remediated using EventBridge and Lambda for a faster incident response?

Intermediate

Answer

GuardDuty findings can be routed to EventBridge, which can then trigger an automated response, such as invoking a Lambda function that automatically isolates a compromised EC2 instance by changing its security group to block all traffic, or revoking temporary credentials that appear to have been compromised, allowing an organization to respond to certain types of threats within seconds rather than waiting for a human analyst to manually review and act on every single finding.
aws events put-rule --name guardduty-auto-remediation --event-pattern '{"source":["aws.guardduty"],"detail-type":["GuardDuty Finding"]}'
Real-world example A security team configures an automated response that immediately isolates any EC2 instance flagged by GuardDuty for suspected cryptocurrency mining activity, containing the potential threat within seconds instead of waiting for manual analyst review.

Common follow-ups: What are the risks of fully automating incident response without any human review?;How do you test an automated remediation workflow safely before enabling it in production?

Amazon EventBridge;Lambda & Serverless
All 7 AWS Security Hub & GuardDuty questions