Reading and Prioritizing GuardDuty Findings

A busy account can generate many findings, and not all matter equally. To respond well you must prioritize, focusing first on the threats most likely to cause real harm. GuardDuty supports this with severity scores and rich finding detail that guide where to look first.

Every GuardDuty finding carries a severity value from 0.1 to 8.9 and above, mapped to levels. Roughly, 1.0 to 3.9 is Low, 4.0 to 6.9 is Medium, and 7.0 to 8.9 is High. Higher numbers mean greater confidence and potential impact, so they jump the queue.

A High-severity finding suggests a resource is likely compromised and acting maliciously, demanding urgent action. Medium suggests suspicious activity worth investigating. Low often reflects reconnaissance or unusual but not yet harmful behavior. Severity guides urgency, not certainty of breach.

Each finding includes the resource affected, the actor (such as a remote IP and its geolocation), the action observed, and a count of how many times it occurred. Reading these fields turns a one-line alert into a story: who did what, to which resource, from where, and how often.

Findings track first and last seen timestamps and a count. A finding occurring repeatedly over hours is more serious than a single blip. These timing details help you judge whether an attack is ongoing, which strongly affects how fast you must contain it.

The threat purpose shapes your response. A CryptoCurrency finding on an instance means likely mining and warrants isolation. An UnauthorizedAccess finding on an IAM user means a credential may be stolen and warrants key rotation. Matching response to purpose is the heart of triage.

You can create suppression rules to automatically archive findings that match known, expected behavior, such as a vulnerability scanner you run on purpose. This keeps the queue focused on real signals. Suppressed findings still exist for audit but do not distract responders.

GuardDuty can generate sample findings so you can practice triage and test your automation without a real attack. This lets teams build and validate response playbooks safely. Knowing this feature exists is useful for setting up detection-to-response pipelines.

Prioritized findings flow into a response process: high-severity instance compromise might trigger automatic isolation, while a medium identity finding might page an analyst. The severity and type together decide whether automation or a human handles it, and how quickly.

GuardDuty aggregates repeated occurrences of the same finding into a single finding and updates its count and last-seen time rather than creating a flood of duplicates. You can also configure how often updated findings are published to EventBridge and S3. This keeps the queue readable while still reflecting that an attack is ongoing.

By default GuardDuty findings are retained for 90 days. To keep them longer for audit or trend analysis, you export findings to an S3 bucket and configure how often new findings are exported. Sending findings onward to Security Hub and EventBridge also preserves and acts on them. Knowing how findings are retained and exported matters for compliance scenarios.

Prioritize findings by severity.

GuardDuty assigns each finding a severity (roughly Low 1-3.9, Medium 4-6.9, High 7-8.9) plus detail on the resource, actor, action, geolocation, and timing. Prioritize by severity and impact, use the threat purpose to choose a response, and apply suppression rules to silence known-benign noise. Sample findings let you rehearse triage safely.