AWS GuardDuty Triage Board — Response Posture

AWS GuardDuty detectors, threat findings, and response posture that stay operator-readable.

This control plane turns raw GuardDuty exports into one buyer-readable threat-operations surface: detector coverage, credential abuse, runtime compromise, exfiltration signals, stale findings, and the response packets needed before incidents, audits, or release windows drift.

62%

Identity Operations

Credential containment packet

Do not wait for the next deploy cycle before cutting the exfiltrated role path.

Role credential rotation is not fully scheduled across dependent workloads.
6 hours to the next response checkpoint
Status: red

GD-11

78%

Platform SRE

Runtime isolation packet

Instance can be isolated once the forensic capture lands in the incident record.

Forensic snapshot is queued but not yet attached to the compromise incident.
10 hours to the next response checkpoint
Status: yellow

GD-18

57%

Cluster Security

EKS exposure packet

Hold platform changes until API server access posture is verified.

Anonymous access control-plane posture still needs network and auth proof.
8 hours to the next response checkpoint
Status: red

GD-22

71%

Data Security

Finance bucket containment packet

Investigate the S3 read anomaly before more finance exports move out of the expected path.

Expected-reader allowlist has not been reconciled against the GuardDuty event yet.
4 hours to the next response checkpoint
Status: red

GD-31