Respond to an approved EC2 finding type with numeric severity 8 in the same account and Region. The target EC2 instance has one ENI, and the finding includes resource.instanceDetails.instanceId.
Use an approved API-based Automation runbook to restrict new ordinary traffic with a containment SG. Execution roles, the containment SG, and restoration procedures are ready. Preserve evidence; immediate termination of existing connections requires separate verification.
Which TWO configurations correctly select the event and perform the response?
Select the approved finding, pass its EC2 ID, and replace existing SGs with the containment SG. Preserve evidence and configuration and verify traffic restrictions.
Detailed explanation
InstanceId requires an EC2 ID in the form defined by the runbook. The full finding is not that input; extract the correct field and validate it using an actual event.
InstanceId requires an EC2 ID in the form defined by the runbook. The full finding is not that input; extract the correct field and validate it using an actual event.
SG connection tracking can allow existing connections to continue. Verify actual traffic separately from the configuration change and design another approved control when immediate blocking is required.
SG connection tracking can allow existing connections to continue. Verify actual traffic separately from the configuration change and design another approved control when immediate blocking is required.
Permissions from multiple SGs are aggregated. Adding a restrictive group does not cancel permissions from other groups, so retaining groups that allow ordinary traffic does not meet the requirement.
Permissions from multiple SGs are aggregated. Adding a restrictive group does not cancel permissions from other groups, so retaining groups that allow ordinary traffic does not meet the requirement.
For this single-ENI instance, replace the existing SGs without retaining groups that permit ordinary traffic. Verify execution and restrictions on new traffic, recording the original configuration for investigation and restoration. Do not treat the change as a guarantee of immediately terminating existing connections.
For this single-ENI instance, replace the existing SGs without retaining groups that permit ordinary traffic. Verify execution and restrictions on new traffic, recording the original configuration for investigation and restoration. Do not treat the change as a guarantee of immediately terminating existing connections.
Identify aws.guardduty and GuardDuty Finding and select the approved type with severity=8. Extract the target ID from $.detail.resource.instanceDetails.instanceId and pass it to the runbook InstanceId parameter.
Identify aws.guardduty and GuardDuty Finding and select the approved type with severity=8. Extract the target ID from $.detail.resource.instanceDetails.instanceId and pass it to the runbook InstanceId parameter.
Check official documentation
Compare the following points with the official documentation.
Use an approved test instance and sample finding to verify event selection, InstanceId transformation, Automation inputs and execution history, then compare SG associations, new traffic, and existing connections.
Official references
- Official documentation 1
- Official documentation 2
- Official documentation 3
- Official documentation 4
- Official documentation 5
- Official documentation 6
- Official documentation 7
What to confirm
The EC2 target matches the runbook input; the original SG list and replacement are recorded. New traffic restrictions and existing connections are verified separately, and the finding is retained for investigation.
Key points
- GuardDuty finding
- EventBridge
- Isolation runbook
Notes
- Environment: Official GuardDuty, EventBridge, Systems Manager, and EC2 documentation and an approved test environment
- Reviewed against the linked AWS documentation on 2026-10-11.
Foundation review
Connect the finding resource to the runbook input
Match source=aws.guardduty, detail-type=GuardDuty Finding, the approved detail.type, and numeric detail.severity=8. Use an Input Transformer to map $.detail.resource.instanceDetails.instanceId to InstanceId. Validate account, Region, and the current instance; distinguish permissions for EventBridge to start Automation from EC2 operation permissions supplied by AutomationAssumeRole.
Separate SG addition, replacement, and actual traffic
Permissions from multiple SGs are aggregated, so merely adding a containment SG does not cancel existing permissions. For this single-ENI scenario, record the original SGs and replace them with the containment SG. Connection tracking means immediate termination of existing connections is not guaranteed. Measure new traffic and existing connections and consider another approved control for immediate blocking. In a real multi-ENI environment, verify associations on every ENI.
Preserve evidence and handle repeated response
A GuardDuty finding detects suspicious activity; it does not alone establish a confirmed compromise or completed containment. Preserve the finding, target, original SGs, and execution outcome for investigation. Handle updated notifications and retries idempotently, and monitor failures. Check approved investigation paths and restoration procedures; creating a notification rule alone is not completion.