How to triage Amazon GuardDuty findings: severity, finding types, and first steps

What GuardDuty watches

GuardDuty analyzes CloudTrail management events, VPC flow logs, and DNS logs without you configuring those sources, plus optional protection plans for S3 data events, EKS audit logs, runtime monitoring, Lambda network activity, RDS logins, and malware scanning of EBS volumes. It produces findings when behavior matches threat intelligence or anomaly models.

Finding types follow a pattern: ThreatPurpose:ResourceType/ThreatFamily.Detail. For example, UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS means instance role credentials were used from outside AWS.

Severity and response

Severity values map to Low (1.0 to 3.9), Medium (4.0 to 6.9), High (7.0 to 8.9), and Critical (9.0 and above, used for attack sequence findings). A reasonable starting policy is to page on High and Critical, review Medium daily, and review Low weekly for patterns.

Common High findings include credential exfiltration from instances, CryptoCurrency:EC2/BitcoinTool.B for mining, and Backdoor:EC2/C&CActivity for contact with known command-and-control.

Lab: generate and work samples

Enable GuardDuty in a sandbox and generate sample findings. Sample findings are labeled as samples and do not reflect real activity. List High findings, pick an InstanceCredentialExfiltration sample, and read its resource and action sections: which role, which instance, and which remote IP used the credentials.

Write the playbook steps for that type: revoke the role’s sessions, check what the credentials did in CloudTrail, enforce IMDSv2 on the instance, and look for the vulnerability that exposed the credentials.

Snippet

DET=$(aws guardduty list-detectors --query 'DetectorIds[0]' --output text)
aws guardduty create-sample-findings --detector-id $DET
aws guardduty list-findings --detector-id $DET --finding-criteria '{"Criterion":{"severity":{"Gte":7}}}' --query 'FindingIds' --output text |
  xargs aws guardduty get-findings --detector-id $DET --finding-ids --query 'Findings[].{type:Type,sev:Severity,res:Resource.ResourceType}'

Route findings

Send findings to EventBridge and onward to your ticketing or SIEM. Use suppression rules for known benign patterns, such as an internal vulnerability scanner triggering Recon findings, and document each one.

Enable GuardDuty in every region and account through the organization’s delegated administrator. Attackers favor regions where nobody looks.

Diagram

Reading a finding type

UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS

UnauthorizedAccess
Threat purpose.
IAMUser
Resource type affected.
InstanceCredentialExfiltration
Threat family.
OutsideAWS
Detail: credentials used from outside AWS.

Check yourself

1. Which severity range is High in GuardDuty?

2. What does InstanceCredentialExfiltration.OutsideAWS indicate?

3. How should you handle a known internal scanner triggering findings?