AWS › AWS Security Hub & GuardDuty
How should a security team design an end to end incident response workflow that integrates GuardDuty, Security Hub, EventBridge, and Step Functions for both automated triage and human escalation?
AdvancedAnswer
An effective end to end workflow typically routes GuardDuty findings into Security Hub for centralized visibility, uses EventBridge rules to trigger a Step Functions state machine for any high severity finding, with that state machine performing automated triage steps such as gathering additional context about the affected resource, executing safe automated containment actions for well understood threat types, and escalating to a human analyst through SNS or a ticketing system integration for findings that require judgment calls beyond what automation can safely handle.
aws stepfunctions create-state-machine --name incident-response-workflow --definition file://incident-response-definition.jsonReal-world example A security operations team builds a Step Functions workflow that automatically isolates a compromised EC2 instance flagged by GuardDuty, gathers relevant CloudTrail context about the incident, and simultaneously creates a ticket and sends an SNS alert to the on call security engineer for further investigation, all within moments of the original finding.