GuardDuty: severity is not the event count

Two numbers, two jobs

A GuardDuty finding carries a severity from the detector and a count of how many observations were folded into that finding. The score is why a queue might sort the finding upward. The count is how often the detector grouped activity into it. They are not interchangeable, and neither one is a ticket priority by itself.

A score of 8 is not eight events. A count of 40 is not a severity of 40. The note that swaps them sends the wrong page.

Copy the fields, not a blended sentence

Write Severity and Service.Count on separate lines, each with the number from get-findings. If you also mention the type string, keep it as the type, not as a third number. A sentence such as “high, about forty” drops the field names and cannot be checked later.

The score can stay still while the count rises, or the count can be 1 on a finding the detector still scores as high. Say which field changed when you compare two reads of the same finding id.

aws guardduty get-findings --detector-id "$DET" --finding-ids "$FID" \
  --query 'Findings[0].{Id:Id,Sev:Severity,Count:Service.Count,Type:Type}'

What the queue is allowed to do with them

A team can decide that a score at or above a chosen line pages someone, and that the count is context in the note. That decision is a runbook rule you write down. It is not a field on the finding. Do not describe the score as “the number of times this happened.”

Worked case: a score read as a tally

A sandbox finding shows Severity 8.0 and Service.Count 3, type string left as printed. A draft says “eight events in the account, page immediately for each.” The on-call would open eight tickets for one finding id.

The note has one finding id, Severity 8.0, and Count 3. The page, if the runbook uses the score, is one page for that id. The count tells the reader the detector grouped three observations. It is not eight, and it is not a list of three API calls unless a separate log says so.

finding: <id>
Severity: 8.0
Service.Count: 3
type: <string on the finding>
page: one, for this id, if the runbook says the score pages
not: eight events, and not three API names