guardduty-alert

What problem does it solve?

It helps security and IT teams quickly interpret AWS GuardDuty alerts by turning raw findings into actionable triage output, reducing time spent guessing whether activity is benign or malicious.

Core Features & Use Cases

• Finding Retrieval & Filtering: Fetches specific findings by ID or filters by severity to focus triage effort where it matters most.
• Detector-Aware Enrichment: Enumerates GuardDuty detectors and gathers complete finding details for accurate context (resource, timing, and counts).
• Severity-Based Escalation & Remediation Guidance: Classifies findings into attack categories and provides prioritized next steps, including immediate escalation for HIGH/CRITICAL.

Quick Start

Use the guardduty-alert skill to triage an incident by running it for region-scoped active findings at HIGH severity or higher.