Before
Security personnel likely had to receive or inspect GuardDuty alerts, retrieve additional AWS context, and create a Jira issue manually. They then had to identify the alert category, perform the appropriate AWS response in a separate service, and return to Jira to document what was done.
How it works
- Receive the SNS event and either complete the initial subscription or continue with alert processing.
- Retrieve GuardDuty detector context and create a Jira bug containing the alert information.
- Route the alert by category, perform the configured AWS remediation, and add a Jira comment documenting the action.
Workflow details
- Alert intake: The workflow receives an AWS GuardDuty notification through Amazon SNS and checks whether the event represents an initial subscription request or an alert requiring investigation.
- Subscription handling: For an initial subscription path, it subscribes the configured endpoint to the SNS topic so future notifications can be received automatically.
- Investigation and case creation: For an alert, it retrieves the specified GuardDuty detector for additional context and creates a Jira bug containing the GuardDuty alert name.
- Alert-based remediation: The workflow evaluates the alert category and selects an action for Credential Exfiltration, EC2 C&C Finding, or S3 Public Bucket Policy alerts, including applying an S3 bucket policy, creating an EC2 security group, or deleting an IAM user's permissions boundary.
- Operational recordkeeping: After the selected action, the workflow adds a comment to the Jira issue describing the remediation performed, leaving the investigation and response history in the case record.
What changed
GuardDuty notifications now trigger a consistent investigation and response sequence. The workflow automatically creates the Jira case, selects the remediation path for the named alert category, performs the configured AWS action, and records the result in Jira without requiring a separate manual handoff between investigation, cloud administration, and case documentation.
Work removed
Manually subscribing an endpoint for initial notifications, retrieving GuardDuty context, creating Jira bugs, classifying alerts, performing the configured AWS remediation, and copying the remediation details into Jira.
Expected outcome
Each qualifying alert receives one automated Jira case and one of up to three configured alert-specific remediation paths, reducing the recurring triage and documentation sequence while preserving the response history in Jira.
