GuardDuty detector has no high severity findings
guardduty_no_high_severity_findings
GuardDuty detectors are evaluated for the presence of High-severity findings. This surfaces whether any detector currently has findings labeled High by GuardDuty.
Risk
Unresolved High findings often signal active compromise, enabling:
- Data exfiltration and unauthorized access (confidentiality)
- Privilege escalation and tampering (integrity)
- Disruption via malware/crypto-mining (availability)
Attackers can pivot laterally and persist if not contained.
Run this check with Prowler CLI
prowler aws --checks guardduty_no_high_severity_findings
Recommendation
Treat High findings as incidents.
- Prioritize triage and containment; isolate affected resources, rotate secrets
- Automate alerting and response with playbooks; integrate into IR
- Enforce least privilege, network segmentation, and hardened baselines
- Continuously tune detections and remove unused access to prevent recurrence
Remediation
Other
- Sign in to the AWS console and open Amazon GuardDuty
- Use the Region selector to choose a Region where GuardDuty is enabled
- Go to Findings and filter: Severity = High (7-8.9), Archived status = Not archived
- Select all results, click Actions > Archive
- Repeat steps 2-4 for every Region with GuardDuty enabled
- Confirm there are 0 active High severity findings in each Region
Source Code
Resource Type
AwsGuardDutyDetector
References
- https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_findings.html
- https://docs.aws.amazon.com/prescriptive-guidance/latest/vulnerability-management/assess-and-prioritize-security-findings.html
- https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/aws/GuardDuty/findings.html