Last Updated: November 21, 2025
Focus Areas
| Focus |
|---|
Categorize findings by severity, resource, and service
|
Use tags and automation to escalate only actionable alerts
|
Commands & Queries
aws guardduty list-detectors
List GuardDuty detectors
aws guardduty get-findings --finding-ids ...
Inspect a finding
aws ssm send-command --document-name AWS-RunShellScript ...
Remediate compromised hosts
Summary
Triage GuardDuty alerts with tags and automation so responders focus on real risk.
💡 Pro Tip:
Tag resources and automate suppressions for known benign findings.