# Recurring GuardDuty finding types and patterns queried across a multi-quarter window, plus Athena SQL over CloudTrail data, surfacing whether the same attack vectors repeat and whether the same misconfigurations are reintroduced after remediation

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/guardduty-pattern-review-past-incidents

Recipe id: `guardduty-pattern-review-past-incidents` · cadence quarterly · partial

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-INR-RPI`
- control `ir-3`
- control `ir-4`
- control `ir-4.1`
- control `ir-5`
- control `ir-8`

## Collection

Kind: `cli`

```sh
# list-findings
aws guardduty list-findings --detector-id <DETECTOR_ID> --finding-criteria '{"Criterion":{"updatedAt":{"Gte":["<SINCE_EPOCH>"]}}}' --query 'FindingIds[]'
# guardduty-finding-detail
aws guardduty get-findings --detector-id <DETECTOR_ID> --finding-ids <IDS> --query 'Findings[].{Id:Id,Type:Type,Severity:Severity,Resource:Resource.ResourceType,Region:Region,Count:Service.Count,Account:AccountId}'
# securityhub-active-findings
aws securityhub get-findings --filters '{"RecordState":[{"Value":"ACTIVE","Comparison":"EQUALS"}]}' --query 'Findings[].{Id:Id,Title:Title,Type:Types[0],Severity:Severity.Label,Resource:Resources[0].Type,First:FirstObservedAt,Last:LastObservedAt}'
# lookup-events-signin-amazonaws-com
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventSource,AttributeValue=signin.amazonaws.com --start-time 2024-01-01T00:00:00Z --end-time 2024-12-31T23:59:59Z --max-results 50 --query 'Events[].{Name:EventName,Time:EventTime,User:Username}'
```

## Expected output

GuardDuty findings showing their findingType and Count fields (indicating repeat occurrences of the same threat), Security Hub ACTIVE findings with FirstObservedAt and LastObservedAt showing persistence windows, and CloudTrail signin events showing authentication patterns over the year that may indicate repeated lateral-movement or credential-abuse attempts.

## Assertions

_No machine-checkable assertion is authored for this recipe._

## GovCloud

GuardDuty, Security Hub, CloudTrail, Athena and S3 are available in both AWS GovCloud (US-East) and (US-West); findings and trail ARNs use partition arn:aws-us-gov. CloudTrail lookup-events covers 90 days only; older data must come from Athena queries against the trail S3 bucket.

## Notes

IR-3 wants testing for repeated flaws, IR-4/4.1 wants incident handling, IR-5 wants incident monitoring, and IR-8 wants the response plan. The pattern review is the quarterly audit of whether the environment is getting healthier or sicker: a recurring finding type across quarters means the root cause was not fixed, and a high Count on a GuardDuty finding means the same attack vector struck multiple times. The honest gap: finding telemetry does not prove anyone reviewed the pattern — the review is the human step of comparing this quarter against last quarter and recording the conclusion. If the same finding type appears in every quarterly pull, the control is failing even when the telemetry is clean, because the root cause is unaddressed. The CloudTrail signin query is a sample, not exhaustive — replace with an Athena query against your trail S3 bucket for a full year of authentication events. Security Hub FirstObservedAt and LastObservedAt show how long a finding has persisted; a gap between them and the current date means the finding was fixed and then reintroduced. This recipe deliberately states no assertion: the check that matters — this quarter's finding types compared against last quarter's, read against the prior after-action report's root-cause fix — spans two collections and a document, so no single command output decides it. A quarter-over-quarter diff is the reviewer's work, and writing it down as a machine assertion would claim a check nothing can run.

## References

- {"title":"AWS CLI: guardduty get-findings (Type, Severity, Service.Count for repeat detection)","url":"https://docs.aws.amazon.com/cli/latest/reference/guardduty/get-findings.html"}
- {"title":"AWS CLI: securityhub get-findings (FirstObservedAt, LastObservedAt for persistence)","url":"https://docs.aws.amazon.com/cli/latest/reference/securityhub/get-findings.html"}
- {"title":"AWS CLI: cloudtrail lookup-events (90-day window, signin events)","url":"https://docs.aws.amazon.com/cli/latest/reference/cloudtrail/lookup-events.html"}