Recurring GuardDuty finding types and patterns queried across a multi-quarter window, plus Athena SQL over CloudTrail data, surfacing whether the same attack vectors repeat and whether the same misconfigurations are reintroduced after remediation
The API supplies the facts, but a human judgement against a documented baseline turns them into evidence.
Fetch
$ aws guardduty list-findings --detector-id <DETECTOR_ID> --finding-criteria '{"Criterion":{"updatedAt":{"Gte":["<SINCE_EPOCH>"]}}}' --query 'FindingIds[]'$ aws guardduty get-findings --detector-id <DETECTOR_ID> --finding-ids <IDS> --query 'Findings[].{Id:Id,Type:Type,Severity:Severity,Resource:Resource.ResourceType,Region:Region,Count:Service.Count,Account:AccountId}'$ aws securityhub get-findings --filters '{"RecordState":[{"Value":"ACTIVE","Comparison":"EQUALS"}]}' --query 'Findings[].{Id:Id,Title:Title,Type:Types[0],Severity:Severity.Label,Resource:Resources[0].Type,First:FirstObservedAt,Last:LastObservedAt}'$ aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventSource,AttributeValue=signin.amazonaws.com --start-time 2024-01-01T00:00:00Z --end-time 2024-12-31T23:59:59Z --max-results 50 --query 'Events[].{Name:EventName,Time:EventTime,User:Username}'Expected output
GuardDuty findings showing their findingType and Count fields (indicating repeat occurrences of the same threat), Security Hub ACTIVE findings with FirstObservedAt and LastObservedAt showing persistence windows, and CloudTrail signin events showing authentication patterns over the year that may indicate repeated lateral-movement or credential-abuse attempts.
Map — what it proves
- recipe5
- recipe— an authored recipe collects evidence for this control
- KSI only— a Key Security Indicator reaches it, but no recipe is authored yet
- orphan— no Key Security Indicator reaches it — a person writes it up instead
What else these families can fetch:IR 10/24 →
GovCloud
GuardDuty, Security Hub, CloudTrail, Athena and S3 are available in both AWS GovCloud (US-East) and (US-West); findings and trail ARNs use partition arn:aws-us-gov. CloudTrail lookup-events covers 90 days only; older data must come from Athena queries against the trail S3 bucket.
Notes & assertions
IR-3 wants testing for repeated flaws, IR-4/4.1 wants incident handling, IR-5 wants incident monitoring, and IR-8 wants the response plan. The pattern review is the quarterly audit of whether the environment is getting healthier or sicker: a recurring finding type across quarters means the root cause was not fixed, and a high Count on a GuardDuty finding means the same attack vector struck multiple times. The honest gap: finding telemetry does not prove anyone reviewed the pattern — the review is the human step of comparing this quarter against last quarter and recording the conclusion. If the same finding type appears in every quarterly pull, the control is failing even when the telemetry is clean, because the root cause is unaddressed. The CloudTrail signin query is a sample, not exhaustive — replace with an Athena query against your trail S3 bucket for a full year of authentication events. Security Hub FirstObservedAt and LastObservedAt show how long a finding has persisted; a gap between them and the current date means the finding was fixed and then reintroduced. This recipe deliberately states no assertion: the check that matters — this quarter's finding types compared against last quarter's, read against the prior after-action report's root-cause fix — spans two collections and a document, so no single command output decides it. A quarter-over-quarter diff is the reviewer's work, and writing it down as a machine assertion would claim a check nothing can run.
References
- AWS CLI: guardduty get-findings (Type, Severity, Service.Count for repeat detection) https://docs.aws.amazon.com/cli/latest/reference/guardduty/get-findings.html
- AWS CLI: securityhub get-findings (FirstObservedAt, LastObservedAt for persistence) https://docs.aws.amazon.com/cli/latest/reference/securityhub/get-findings.html
- AWS CLI: cloudtrail lookup-events (90-day window, signin events) https://docs.aws.amazon.com/cli/latest/reference/cloudtrail/lookup-events.html
This AWS mapping is authored opinion (overlay v3.0.0), versioned separately from the dataset and written against ruleset 2026.07.14.01. The upstream FedRAMP dataset names none of these tools.
The Incident Response run (3)
- automatable
- partial — needs judgement
- narrative — no API proves this
Every authored recipe filed under INR, in the order the plan works them. The mark says how much of the evidence the command produces on its own.
- partialGuardDuty findings and Security Hub insight summaries that were reviewed, together with evidence that the findings fed into an after-action review cycle — AAR documents stored as versioned S3 objects with the incident IDs they referencequarterlyguardduty-incident-after-actionAmazon GuardDuty · AWS Security Hub · Amazon S3
- partialSecurity Hub finding workflow status plus GuardDuty detection coverage, showing incident response procedures are exercised: enabled insights, automated response actions routed through EventBridge, automated notifications, and Systems Manager Automation documents that encode response stepsmonthlysecurityhub-incident-review-proceduresAWS Security Hub · Amazon GuardDuty · AWS Systems Manager · Amazon CloudWatch
- partialRecurring GuardDuty finding types and patterns queried across a multi-quarter window, plus Athena SQL over CloudTrail data, surfacing whether the same attack vectors repeat and whether the same misconfigurations are reintroduced after remediationyou are herequarterlyguardduty-pattern-review-past-incidentsAmazon GuardDuty · AWS CloudTrail · AWS Security Hub · Amazon Athena · Amazon S3