guardduty-triage
Skill0 starsChanged 14 days agoMITView on GitHub
Triage Amazon GuardDuty findings (and correlated Security Hub/Detective data) — understand finding types (UnauthorizedAccess, CredentialAccess, Recon, CryptoCurrency, Exfiltration, Runtime, Malware Protection, Attack Sequence), validate with CloudTrail/VPC/DNS logs, and respond. Use when a GuardDuty finding fires or when tuning GuardDuty suppression rules.
In this repository273 other files it gives its agents.
- ad-attack-path-analysisSkill
- adcs-security-reviewSkill
- ad-privileged-access-reviewSkill
- dcsync-detectionSkill
- gpo-security-reviewSkill
- kerberos-attack-detectionSkill
- agent-tool-permission-reviewSkill
- ai-incident-responseSkill
- llm-gateway-controlsSkill
- llm-security-evaluationSkill
- mcp-server-security-reviewSkill
- model-artifact-securitySkill
- prompt-injection-reviewSkill
- rag-security-reviewSkill
- api-abuse-detectionSkill
- api-authorization-testingSkill
- api-inventorySkill
- api-schema-securitySkill
- dast-baselineSkill
- sast-triageSkill
- sca-dependency-riskSkill
- secure-code-reviewSkill
- security-requirementsSkill
- threat-modelingSkill
- asset-criticality-tieringSkill
- asset-inventory-reconciliationSkill
- external-attack-surface-reviewSkill
- shadow-it-discoverySkill
- aws-credential-compromiseSkill
- aws-iam-reviewSkill
- aws-org-guardrailsSkill
- cloudtrail-investigationSkill
- s3-exposure-reviewSkill
- azure-activity-investigationSkill
- azure-rbac-reviewSkill
- conditional-access-reviewSkill
- entra-audit-investigationSkill
- entra-signin-investigationSkill
- backup-assuranceSkill
- critical-service-mappingSkill
- ransomware-recoverySkill
- recovery-exerciseSkill
- cloud-exposure-reviewSkill
- cloud-incident-responseSkill
- cloud-logging-baselineSkill
- cloud-posture-assessmentSkill
- audit-evidence-packageSkill
- continuous-control-monitoringSkill
- control-mappingSkill
- control-testing-samplingSkill
- container-incidentSkill
- dockerfile-hardeningSkill
- image-scanningSkill
- runtime-detection-falcoSkill
- db-audit-loggingSkill
- db-exfiltration-investigationSkill
- db-hardeningSkill
- db-privilege-reviewSkill
- data-classificationSkill
- data-discoverySkill
- The first 60 shown.
The file
Files
GuardDuty Triage
Get finding details
aws guardduty list-detectors
aws guardduty list-findings --detector-id <id> --finding-criteria '{"Criterion":{"severity":{"Gte":7}}}'
aws guardduty get-findings --detector-id <id> --finding-ids <fid> > finding.json
jq '.Findings[0] | {Type, Severity, Resource, Service: .Service | {Action, Evidence, Count, EventFirstSeen, EventLastSeen}}' finding.jsonFinding type format: ThreatPurpose:ResourceTypeAffected/ThreatFamilyName.DetectionMechanism!Artifact, e.g. UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS.
High-priority types (examples)
| Finding | Meaning | First checks |
UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS / .InsideAWS | EC2 role credentials used from another host | Instance compromise (SSRF/IMDSv1?); CloudTrail for that session key |
CredentialAccess:IAMUser/AnomalousBehavior, Discovery:IAMUser/AnomalousBehavior | ML-anomalous API use | Who/where; cloudtrail-investigation |
Stealth:IAMUser/CloudTrailLoggingDisabled | Trail stopped | Immediate incident |
Policy:IAMUser/RootCredentialUsage | Root used | Verify with owner |
CryptoCurrency:EC2/BitcoinTool.B!DNS | Mining pool DNS from instance | Instance compromise |
Backdoor:EC2/C&CActivity.B!DNS | Known C2 domain lookup | Isolate instance |
Execution:Runtime/*, PrivilegeEscalation:Runtime/* | Runtime Monitoring on EC2/EKS/ECS | Process/container details in finding |
Exfiltration:S3/AnomalousBehavior, Impact:S3/* | Unusual S3 data access/deletion | S3 data events, Macie for data sensitivity |
AttackSequence:* | GuardDuty-correlated multi-stage sequence (extended threat detection) | Treat as incident |
Finding type names change over time — consult the current finding types list.
Validate
Correlate with CloudTrail (API activity of the principal), VPC Flow Logs (connections), Route 53 Resolver logs (DNS), EKS audit logs; Amazon Detective graphs if enabled. Check if the source IP is your own scanner/pen test (document and suppress narrowly).
Respond
EC2: isolate by replacing security groups with an isolation SG (no inbound/outbound), snapshot EBS, capture memory if possible (forensic-imaging), detach/disable instance profile credentials (revoke role sessions). IAM: aws-credential-compromise. S3: block public access, review bucket policy.
Suppression
Suppression rules should match finding type + specific resource/IP (e.g., vulnerability scanner IP for Recon:EC2/Portscan), never entire finding types.
Related skills
cloudtrail-investigation, aws-credential-compromise, cloud-incident-response, alert-triage
References
- GuardDuty finding types: https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-active.html
- GuardDuty remediation guidance: https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_remediate.html
- AWS Security Incident Response Guide: https://docs.aws.amazon.com/security-ir/latest/userguide/
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.