Deploy and Configure Security Incident Response

1. Access Security Incident Response from the Management Account console

2. Choose Sign up

   

3. Select a security tooling account as Delegated Administrator from the Management Account.

   • Security Reference Architecture

   • Delegated Administrator documentation

     

4. Log into the delegated administrator account

5. Enter membership details and associate accounts

   

6. Enable proactive response

Note

Enabling proactive response creates a service-linked role allowing our CIRT to ingest GuardDuty findings and create proactive investigation cases.