AWS GuardDuty Response Cheat Sheet

Alert triage and automation for GuardDuty findings

Last Updated: November 21, 2025

Focus Areas

Focus
Categorize findings by severity, resource, and service
Use tags and automation to escalate only actionable alerts

Commands & Queries

aws guardduty list-detectors
List GuardDuty detectors
aws guardduty get-findings --finding-ids ...
Inspect a finding
aws ssm send-command --document-name AWS-RunShellScript ...
Remediate compromised hosts

Summary

Triage GuardDuty alerts with tags and automation so responders focus on real risk.

💡 Pro Tip: Tag resources and automate suppressions for known benign findings.
← Back to Security & Privacy | Browse all categories | View all cheat sheets