# GuardDuty findings and Security Hub insight summaries that were reviewed, together with evidence that the findings fed into an after-action review cycle — AAR documents stored as versioned S3 objects with the incident IDs they reference

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/guardduty-incident-after-action

Recipe id: `guardduty-incident-after-action` · cadence quarterly · partial

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-INR-AAR`
- control `ir-3`
- control `ir-4`
- control `ir-4.1`
- control `ir-8`

## Collection

Kind: `cli`

```sh
# guardduty-list-findings
aws guardduty list-findings --detector-id <DETECTOR_ID> --finding-criteria '{"Criterion":{"severity":{"Gte":[4]},"updatedAt":{"Gte":["<SINCE_EPOCH>"]}}}' --query 'FindingIds[]'
# guardduty-finding-detail
aws guardduty get-findings --detector-id <DETECTOR_ID> --finding-ids <FINDING_ID_1> <FINDING_ID_2> --query 'Findings[].{Id:Id,Type:Type,Severity:Severity,Resource:Resource.ResourceType,Region:Region,Time:UpdatedAt,Desc:Description}'
# securityhub-insights
aws securityhub get-insights --query 'Insights[].{Arn:InsightArn,Name:Name,Filters:Filters,GroupBy:GroupByAttr}'
# securityhub-insight-results
aws securityhub get-insight-results --insight-arn <INSIGHT_ARN>
# after-action-reports
aws s3api list-objects-v2 --bucket <EVIDENCE_BUCKET> --prefix after-action-reports/ --query 'Contents[].{Key:Key,Size:Size,Modified:LastModified}'
```

## Expected output

A list of GuardDuty findings with severity >= 4 (medium+), their IDs, types, affected resource types and update timestamps; Security Hub insight names and result counts showing which insights are actively matching; and a non-empty S3 object list under after-action-reports/ whose keys include finding IDs or incident reference numbers, proving findings are linked to AARs rather than reviewed in isolation and forgotten.

## Assertions

- {"field":"after-action-reports","op":"exists","controls":["ir-3","ir-4","ir-8"],"description":"At least one after-action report exists as a versioned S3 object, proving findings were reviewed beyond the event itself."}

## GovCloud

GuardDuty, Security Hub and S3 are available in both AWS GovCloud (US-East) and (US-West); detector, hub and bucket ARNs use partition arn:aws-us-gov.

## Notes

IR-3 wants incident response tested, IR-4 wants incidents handled and lessons learned applied, IR-4.1 wants automated handling support, and IR-8 wants an incident response plan. GuardDuty findings and Security Hub insights are telemetry, not proof that anyone acted on them. The S3 AAR objects close the loop: they show someone reviewed the finding, and that the review produced a document. What the API cannot prove is that the lessons were actually incorporated into the plan — that is a human judgement from the AAR content. An after-action report without a recommendation-to-plan-change linkage is a finding without a fix. If no AARs exist yet, this recipe is the trigger to create them, not evidence that the control is satisfied. Substitute your detector ID, evidence bucket name and insight ARNs. GuardDuty list-findings returns at most 50 findings per page; add --max-results and --next-token pagination for a full quarter.

## References

- {"title":"AWS CLI: guardduty list-findings (severity and date filters)","url":"https://docs.aws.amazon.com/cli/latest/reference/guardduty/list-findings.html"}
- {"title":"AWS CLI: securityhub get-insights","url":"https://docs.aws.amazon.com/cli/latest/reference/securityhub/get-insights.html"}
- {"title":"AWS CLI: s3api list-objects-v2","url":"https://docs.aws.amazon.com/cli/latest/reference/s3api/list-objects-v2.html"}