# Security Hub finding workflow status plus GuardDuty detection coverage, showing incident response procedures are exercised: enabled insights, automated response actions routed through EventBridge, automated notifications, and Systems Manager Automation documents that encode response steps

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/securityhub-incident-review-procedures

Recipe id: `securityhub-incident-review-procedures` · cadence monthly · partial

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-INR-RIR`
- control `ir-4`
- control `ir-4.1`
- control `ir-6`
- control `ir-6.1`
- control `ir-6.3`
- control `ir-7`
- control `ir-7.1`
- control `ir-8`
- control `ir-8.1`
- control `si-4.5`

## Collection

Kind: `cli`

```sh
# resolved-high-findings
aws securityhub get-findings --filters '{"WorkflowStatus":[{"Value":"RESOLVED","Comparison":"EQUALS"}],"SeverityLabel":[{"Value":"HIGH","Comparison":"EQUALS"}]}' --query 'Findings[].{Id:Id,Title:Title,Type:Types[0],Severity:Severity.Label,Resource:Resources[0].Id,Updated:UpdatedAt}'
# guardduty-detector-id
aws guardduty list-detectors --query 'DetectorIds[0]'
# guardduty-detector
aws guardduty get-detector --detector-id <DETECTOR_ID> --query '{Status:Status,Features:Features[].{Name:Name,Status:Status}}'
# guardduty-event-rules
aws events list-rules --name-prefix guardduty --query 'Rules[].{Name:Name,Pattern:EventPattern,Targets:State}'
# automation-documents
aws ssm list-documents --filters Key=Owner,Values=Self --filters Key=DocumentType,Values=Automation --query 'DocumentIdentifiers[].{Name:Name,Owner:Owner,Version:DocumentVersion,Type:DocumentType}'
# securityhub-alarms
aws cloudwatch describe-alarms --alarm-name-prefix SecurityHub --query 'MetricAlarms[].{Name:AlarmName,State:StateValue,Actions:AlarmActions,Metric:MetricName}'
```

## Expected output

Security Hub findings that reached RESOLVED status (proving the workflow was exercised end-to-end), GuardDuty detector status with features showing which data sources are enabled, EventBridge rules prefixed with guardduty that route findings to targets, Systems Manager Automation documents owned by the account that encode response steps, and CloudWatch alarms that fire on Security Hub metrics.

## Assertions

- {"field":"resolved-high-findings.Findings","op":"exists","controls":["ir-4","ir-4.1","ir-8"],"description":"The RESOLVED/HIGH get-findings call returns a non-empty Findings array within the review window, proving the incident response workflow was exercised end to end rather than merely configured."}

## GovCloud

Security Hub, GuardDuty, EventBridge, Systems Manager and CloudWatch are available in both AWS GovCloud (US-East) and (US-West); findings and document ARNs use partition arn:aws-us-gov. GovCloud FIPS endpoints are used by default for all services.

## Notes

IR-4 wants incident handling capability, IR-4.1 wants automated incident handling, IR-6/6.1/6.3 want reporting to authorities with automated support, IR-7/7.1 want response assistance/coordination, IR-8/8.1 want the incident response plan and its updates, and SI-4.5 wants system monitoring. The evidence here is the infrastructure of response, not the act of responding: resolved findings show the workflow was used, enabled GuardDuty features show detection is active, EventBridge rules show automated routing exists, SSM Automation documents show response steps are encoded as code, and CloudWatch alarms show monitoring. What none of this proves is that the procedures are effective, that notifications reached the right authorities within SLA, or that the incident response plan was actually updated after the event. Those are narrative gaps filled by the plan document, notification records, and AARs. The workflow status is the only pass/fail field here — a finding stuck in NEW or NOTIFIED rather than RESOLVED is a control failure. Substitute your detector ID.

## References

- {"title":"AWS CLI: securityhub get-findings (WorkflowStatus and SeverityLabel filters)","url":"https://docs.aws.amazon.com/cli/latest/reference/securityhub/get-findings.html"}
- {"title":"AWS CLI: events list-rules (EventBridge guardduty rules)","url":"https://docs.aws.amazon.com/cli/latest/reference/events/list-rules.html"}
- {"title":"AWS CLI: ssm list-documents (Automation documents)","url":"https://docs.aws.amazon.com/cli/latest/reference/ssm/list-documents.html"}
- {"title":"AWS CLI: cloudwatch describe-alarms","url":"https://docs.aws.amazon.com/cli/latest/reference/cloudwatch/describe-alarms.html"}