guardduty-alert

Triage AWS GuardDuty security findings and produce structured severity-based reports.

Updated Aug 23, 2026

Search Tags:#aws #remediation #incident response #guardduty #severity classification #security triage #cloud threat detection

Ready to run

npx skills add https://github.com/afoxnyc3/chelsea-piers-itops --skill guardduty-alert

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: guardduty-alert
Source: https://github.com/afoxnyc3/chelsea-piers-itops/tree/main/plugins/aws-security/skills/guardduty-alert
Command: npx skills add https://github.com/afoxnyc3/chelsea-piers-itops --skill guardduty-alert

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It helps security and IT teams quickly interpret AWS GuardDuty alerts by turning raw findings into actionable triage output, reducing time spent guessing whether activity is benign or malicious.

Core Features & Use Cases

Finding Retrieval & Filtering: Fetches specific findings by ID or filters by severity to focus triage effort where it matters most.
Detector-Aware Enrichment: Enumerates GuardDuty detectors and gathers complete finding details for accurate context (resource, timing, and counts).
Severity-Based Escalation & Remediation Guidance: Classifies findings into attack categories and provides prioritized next steps, including immediate escalation for HIGH/CRITICAL.

Quick Start

Use the guardduty-alert skill to triage an incident by running it for region-scoped active findings at HIGH severity or higher.

Frequently Asked Questions about guardduty-alert

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I triage AWS GuardDuty findings to determine remediation priority?▼

Triage AWS GuardDuty findings by retrieving and parsing active alerts, mapping finding types to attack categories, and producing a structured severity-based report with prioritized escalation actions for incident response.

How does severity classification work for AWS GuardDuty cloud threat detection alerts?▼

Severity classification maps raw GuardDuty finding types to attack categories and generates prioritized next steps, triggering immediate escalation for HIGH and CRITICAL alerts to guide security triage decisions.

What's the best way to filter AWS GuardDuty alerts during a security incident investigation?▼

Filter AWS GuardDuty alerts by fetching specific findings via ID or scoping retrieval by severity level, allowing security teams to focus threat-hunting efforts on region-scoped active findings that matter most.

Can I retrieve complete context for specific GuardDuty findings across different detectors?▼

Retrieve complete GuardDuty finding context by enumerating detectors and gathering full details including affected resources, timing, and counts for accurate incident investigation and alert review.

Does this GuardDuty triage approach work for region-scoped active findings at HIGH severity?▼

Yes, this GuardDuty triage approach works for region-scoped active findings at HIGH severity or higher, classifying cloud threat detections into attack categories to produce structured remediation guidance.

What problem does automated GuardDuty alert triage solve for IT security teams?▼

Automated GuardDuty alert triage solves the problem of interpreting raw findings by turning them into actionable outputs, reducing the time spent guessing whether cloud activity is benign or malicious.