GuardDuty: archived is a workflow flag, not a closed case

The flag is a filing state

GuardDuty keeps a finding when someone archives it. Service.Archived true means it was filed out of the default active view. It does not mean the activity was explained, the resource was fixed, or a person accepted the risk. Those are sentences in a ticket, and they have to be written on purpose.

A finding can be archived by a suppression rule as well as by a click. If you do not know which, say so. Do not invent an owner from the flag.

The view you used is part of the result

The console and the API both default toward findings that are not archived. A list that comes back empty was produced by that filter. Write the filter, including whether archived findings were included. “No high-score findings” is only true for the filter you ran.

To see the filed ones, include them in the query or open the archived view, then record that you did. Otherwise a later reader thinks the account had nothing.

aws guardduty get-findings --detector-id "$DET" --finding-ids "$FID" \
  --query 'Findings[0].{Id:Id,Archived:Service.Archived,Sev:Severity}'

What to file

File the finding id, Service.Archived, the severity, and the view or criteria you used. If a ticket explains the archive, cite the ticket id. If nothing explains it, write “no ticket linked.” Do not write “resolved” unless the ticket uses that word and you point at it.

Worked case: an empty list that hid one finding

The sandbox review looks at high scores and sees none. The criteria omitted archived findings. One finding id, severity 7.2, has Service.Archived true and no ticket id in the team’s tracker. A draft says the account is clear.

The note says the first list excluded archived findings, then quotes the id, severity 7.2, Archived true, and “no ticket linked.” The account is not described as clear. The next step is to find who archived it or to unarchive it for review, not to close the week.

view: high scores, archived excluded
result: empty
then: same detector, this id included
finding: <id>  Severity: 7.2  Service.Archived: true
ticket: none linked
write: hidden by the filter, not resolved