Skip to content
FedRAMP Rules Hub
JSON — GET /api/aws-evidence

Keyboard shortcuts

Go

  • Scope — the control cataloggm
  • Plan — your last certification classgp
  • Collect — the recipe indexgc
  • The control you are workinggw
  • Startgh

Move

  • Next rowj
  • Previous rowk
  • Previous in this run[
  • Next in this run]
  • Filter this page's list/
  • Search everything⌘K

Act

  • Copy this page's permalinky
  • Toggle dark moded
  • This sheet?

Rows are whatever the current page lists — controls on Scope, recipes on Plan and Collect.

Control index

GuardDuty findings and Security Hub insight summaries that were reviewed, together with evidence that the findings fed into an after-action review cycle — AAR documents stored as versioned S3 objects with the incident IDs they reference

JSON — GET /api/aws-evidenceMD — /collect/guardduty-incident-after-action.md — this page as markdown, for pasting into an agent

The API supplies the facts, but a human judgement against a documented baseline turns them into evidence.

partial — needs judgementcliquarterlyAmazon GuardDutyAWS Security HubAmazon S3

Fetch

$ aws guardduty list-findings --detector-id <DETECTOR_ID> --finding-criteria '{"Criterion":{"severity":{"Gte":[4]},"updatedAt":{"Gte":["<SINCE_EPOCH>"]}}}' --query 'FindingIds[]'
$ aws guardduty get-findings --detector-id <DETECTOR_ID> --finding-ids <FINDING_ID_1> <FINDING_ID_2> --query 'Findings[].{Id:Id,Type:Type,Severity:Severity,Resource:Resource.ResourceType,Region:Region,Time:UpdatedAt,Desc:Description}'
$ aws securityhub get-insights --query 'Insights[].{Arn:InsightArn,Name:Name,Filters:Filters,GroupBy:GroupByAttr}'
$ aws securityhub get-insight-results --insight-arn <INSIGHT_ARN>
$ aws s3api list-objects-v2 --bucket <EVIDENCE_BUCKET> --prefix after-action-reports/ --query 'Contents[].{Key:Key,Size:Size,Modified:LastModified}'

Expected output

A list of GuardDuty findings with severity >= 4 (medium+), their IDs, types, affected resource types and update timestamps; Security Hub insight names and result counts showing which insights are actively matching; and a non-empty S3 object list under after-action-reports/ whose keys include finding IDs or incident reference numbers, proving findings are linked to AARs rather than reviewed in isolation and forgotten.

Assertions — what makes it a pass

Assertions for GuardDuty findings and Security Hub insight summaries that were reviewed, together with evidence that the findings fed into an after-action review cycle — AAR documents stored as versioned S3 objects with the incident IDs they reference: the field checked, the condition it must satisfy, the rows it applies to, and the controls a pass proves.
FieldMust beForProves
after-action-reportsexistsAt least one after-action report exists as a versioned S3 object, proving findings were reviewed beyond the event itself.every rowIR-03IR-04IR-08

Authored opinion, like the commands. Units live in the operator name — max-age-days is days, and nothing here is converted for you.

Map — what it proves

  • recipe4
Key Security Indicators
KSI-INR-AAR
NIST 800-53 controls
recipe · 2 recipesIR-03recipe · 3 recipesIR-04recipe · 3 recipesIR-04 (01)recipe · 3 recipesIR-08
  • recipe— an authored recipe collects evidence for this control
  • KSI only— a Key Security Indicator reaches it, but no recipe is authored yet
  • orphan— no Key Security Indicator reaches it — a person writes it up instead

What else these families can fetch:IR 10/24 →

GovCloud

GuardDuty, Security Hub and S3 are available in both AWS GovCloud (US-East) and (US-West); detector, hub and bucket ARNs use partition arn:aws-us-gov.

Notes & assertions

IR-3 wants incident response tested, IR-4 wants incidents handled and lessons learned applied, IR-4.1 wants automated handling support, and IR-8 wants an incident response plan. GuardDuty findings and Security Hub insights are telemetry, not proof that anyone acted on them. The S3 AAR objects close the loop: they show someone reviewed the finding, and that the review produced a document. What the API cannot prove is that the lessons were actually incorporated into the plan — that is a human judgement from the AAR content. An after-action report without a recommendation-to-plan-change linkage is a finding without a fix. If no AARs exist yet, this recipe is the trigger to create them, not evidence that the control is satisfied. Substitute your detector ID, evidence bucket name and insight ARNs. GuardDuty list-findings returns at most 50 findings per page; add --max-results and --next-token pagination for a full quarter.

References

This AWS mapping is authored opinion (overlay v3.0.0), versioned separately from the dataset and written against ruleset 2026.07.14.01. The upstream FedRAMP dataset names none of these tools.

The Incident Response run (3)

  • automatable
  • partial — needs judgement
  • narrative — no API proves this

Every authored recipe filed under INR, in the order the plan works them. The mark says how much of the evidence the command produces on its own.