skills.rest
afoxnyc3
afoxnyc3COMMUNITY
Explore all skills by this author →
𝕏@afoxnyc1GitHub

guardduty-alert

Triage AWS GuardDuty security findings and produce structured severity-based reports.

Updated Aug 23, 2026
Search Tags:#aws#remediation#incident response#guardduty#severity classification#security triage#cloud threat detection
One-click install
npx skills add https://github.com/afoxnyc3/chelsea-piers-itops --skill guardduty-alert
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: guardduty-alert
Source: https://github.com/afoxnyc3/chelsea-piers-itops/tree/main/plugins/aws-security/skills/guardduty-alert
Command: npx skills add https://github.com/afoxnyc3/chelsea-piers-itops --skill guardduty-alert

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It helps security and IT teams quickly interpret AWS GuardDuty alerts by turning raw findings into actionable triage output, reducing time spent guessing whether activity is benign or malicious.

Core Features & Use Cases

  • Finding Retrieval & Filtering: Fetches specific findings by ID or filters by severity to focus triage effort where it matters most.
  • Detector-Aware Enrichment: Enumerates GuardDuty detectors and gathers complete finding details for accurate context (resource, timing, and counts).
  • Severity-Based Escalation & Remediation Guidance: Classifies findings into attack categories and provides prioritized next steps, including immediate escalation for HIGH/CRITICAL.

Quick Start

Use the guardduty-alert skill to triage an incident by running it for region-scoped active findings at HIGH severity or higher.

Frequently Asked Questions about guardduty-alert

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I triage AWS GuardDuty findings to determine remediation priority?▼

Triage AWS GuardDuty findings by retrieving and parsing active alerts, mapping finding types to attack categories, and producing a structured severity-based report with prioritized escalation actions for incident response.

How does severity classification work for AWS GuardDuty cloud threat detection alerts?▼

Severity classification maps raw GuardDuty finding types to attack categories and generates prioritized next steps, triggering immediate escalation for HIGH and CRITICAL alerts to guide security triage decisions.

What's the best way to filter AWS GuardDuty alerts during a security incident investigation?▼

Filter AWS GuardDuty alerts by fetching specific findings via ID or scoping retrieval by severity level, allowing security teams to focus threat-hunting efforts on region-scoped active findings that matter most.

Can I retrieve complete context for specific GuardDuty findings across different detectors?▼

Retrieve complete GuardDuty finding context by enumerating detectors and gathering full details including affected resources, timing, and counts for accurate incident investigation and alert review.

Does this GuardDuty triage approach work for region-scoped active findings at HIGH severity?▼

Yes, this GuardDuty triage approach works for region-scoped active findings at HIGH severity or higher, classifying cloud threat detections into attack categories to produce structured remediation guidance.

What problem does automated GuardDuty alert triage solve for IT security teams?▼

Automated GuardDuty alert triage solves the problem of interpreting raw findings by turning them into actionable outputs, reducing the time spent guessing whether cloud activity is benign or malicious.

Related Skills

Explore More Legal & Compliance Skills→
YukiIto1999YukiIto1999

detecting-aws-guardduty-findings-automation

Automate AWS GuardDuty finding processing with EventBridge and Lambda.

Community
Intermediate
TheSethRoseTheSethRose

threat-mitigation-mapping

Map identified threats to security controls with risk scoring and mitigation plans.

Community
Advanced
YukiIto1999YukiIto1999

performing-cloud-native-threat-hunting-with-aws-detective

Automate AWS Detective threat hunting across behavior graphs, investigations, and indicators.

Community
Advanced
ivegamsftivegamsft

security-operations

Automate security monitoring, threat detection, and incident response workflows for Kubernetes environments.

Community
Advanced