Managing Amazon GuardDuty Findings - Amazon GuardDuty

Managing Amazon GuardDuty Findings

GuardDuty offers several important features to help you sort, store, and manage your findings. These features will help you tailor findings to your specific environment, reduce noise from low value findings, and help you focus on threats to your unique AWS environment. Review the topics on this page to understand how you can use these features to increase the value of GuardDuty's findings.

Topics:

Filtering Findings

Learn how to filter GuardDuty findings based on criteria you specify.

Suppression Rules

Learn how to automatically filter the findings GuardDuty alerts you to through suppression rules. Suppression rules automatically archive findings based on filters.

Working with Trusted IP Lists and Threat Lists

Customize the GuardDuty monitoring scope using IP Lists and Threat Lists based on publicly-routable IP addresses. Trusted IP lists prevent non-DNS findings from being generated from IP's you consider trusted, while Threat Intel Lists will cause GuardDuty to alert you of activity from user-defined IPs.

Exporting Findings

Configure automatic exporting of your findings to an S3 Bucket so you can maintain records past 30 days. This historical data can be used to track suspicious activity in your account and help you evaluate whether your remediation actions were successful.

Creating Custom Responses to GuardDuty Findings with Amazon CloudWatch Events

Set up automatic notifications for GuardDuty findings through Amazon CloudWatch events. You can also automate other tasks through CloudWatch Events to help you respond to findings.