GuardDuty: the description is generated text

The paragraph is not the type

A finding can include a Description, a paragraph that explains the type in sentences. That paragraph is generated text. The Type string is the name of the finding. Quote Type when you say what the detector called it. Quote Description only as the paragraph, and do not treat its sentences as API names you observed.

A sentence in the description can mention a service or an action in general terms. It is not a CloudTrail row. If you need the calls, they come from a query you cite, not from the paragraph.

Do not tighten the paragraph

Do not add API names, counts, or account ids into a quote of the description. If those facts are in other fields, cite the fields. A cleaned-up description looks like evidence and is no longer the field.

If Description is absent, write “description not on this finding.” Do not draft a paragraph and label it as the service’s text.

What to file

File the finding id, the region, the Type string, and, if you include it, the Description labeled as generated text. File any API list from its own query. Do not file the description as that list.

Worked case: a paragraph turned into three calls

A sandbox finding’s Type is a printed string about unusual API activity. The Description mentions listing and reading in general words. A draft writes three API names and times under the description, as if the paragraph were a log.

The note quotes Type as the name and Description as generated text, with no API names added. It says calls were not listed from this field. A CloudTrail query, if someone runs one, will be a separate citation. The three invented calls are removed.

finding: <id>  region: us-east-1
Type: <string on the finding>
Description: generated paragraph, quoted only as text
API names added by the draft: removed
calls: not listed from this field