Setting the file. One moment.
Subchapter 41.5
references/guardduty-findings.mdMarkdown4 KBView on GitHub
Produces structured summaries of active GuardDuty findings — severity distribution, type breakdown, and affected resources. Does NOT perform triage, investigation, or remediation.
Works from both standalone accounts and delegated administrator accounts.
| User intent | Workflow |
|---|---|
| Summarize my GuardDuty findings | A: Account Findings Summary |
| What threats is GuardDuty detecting | A: Account Findings Summary |
| Show findings across my org | B: Organization Findings Overview |
| Which accounts have the most findings | B: Organization Findings Overview |
Get the detector ID:
aws guardduty list-detectorsGet finding statistics (active findings only):
aws guardduty get-findings-statistics --detector-id <DETECTOR_ID> --finding-statistic-types COUNT_BY_SEVERITY --finding-criteria '{"Criterion":{"service.archived":{"Eq":["false"]}}}'Severity mapping: 9.0+ = Critical, 7.0–8.9 = High, 4.0–6.9 = Medium, 1.0–3.9 = Low
List findings sorted by severity (most severe first):
aws guardduty list-findings --detector-id <DETECTOR_ID> --sort-criteria '{"AttributeName":"severity","OrderBy":"DESC"}' --finding-criteria '{"Criterion":{"service.archived":{"Eq":["false"]}}}'Get finding details in batches (max 50 per call):
aws guardduty get-findings --detector-id <DETECTOR_ID> --finding-ids <IDS>Group findings by:
AttackSequence: MUST be surfaced in a separate section at the top. These represent correlated multi-step attacks and are the most actionable findings.Present summary:
Attack Sequences (always first):
| Finding Type | Severity | Affected Resources |
|---|---|---|
| AttackSequence:… | CRITICAL | … |
Severity Breakdown:
| Severity | Count |
|---|---|
| Critical | N |
| High | N |
| Medium | N |
| Low | N |
| Finding Type Prefix | Count | Highest Severity |
|---|---|---|
| UnauthorizedAccess: | N | HIGH |
| Recon: | N | MEDIUM |
| Resource Type | Count | Top Finding Types |
|---|---|---|
| Instance | N | … |
| AccessKey | N | … |
Get the detector ID:
aws guardduty list-detectorsList findings across organization (delegated admin sees all member findings):
aws guardduty list-findings --detector-id <DETECTOR_ID> --sort-criteria '{"AttributeName":"severity","OrderBy":"DESC"}' --finding-criteria '{"Criterion":{"service.archived":{"Eq":["false"]}}}'Get finding details in batches:
aws guardduty get-findings --detector-id <DETECTOR_ID> --finding-ids <IDS>Group by account ID, then by severity and type.
Present summary:
| Account ID | Critical | High | Medium | Low | Total |
|---|---|---|---|---|---|
| 111111111111 | N | N | N | N | N |
MUST identify the top 5 accounts by critical+high findings count.
| Symptom | Resolution |
|---|---|
| list-findings returns empty | No active findings or all archived — report zero active findings |
| get-findings-statistics unavailable | Use list-findings and count client-side |
| Only sees own account findings | Not a delegated admin — note: showing single-account view only |
Finding details contain IP addresses, network connections, DNS queries, process details, and resource identifiers. Present the severity/type summary table first. Display full finding JSON bodies only when the caller explicitly requests raw output.