Threat Detection And Security Response — AWS Solutions Architect Pro (SAP-C02)

GuardDuty Generates Findings; EventBridge Routes Them to Action

GuardDuty analyzes VPC flow logs, DNS query logs, and CloudTrail events to detect threats. It does not take remediation action. The response pipeline is a separate architectural decision. EventBridge receives GuardDuty findings and routes them to Lambda for automated isolation or to SNS for human escalation, depending on finding type and confidence level. High-confidence findings with narrow blast radius, such as a known malicious IP communicating with an EC2 instance, justify fully automated response via Lambda. Lower-confidence or broader findings should route to a Step Functions workflow that inserts a human approval step before any destructive action executes, preventing false-positive blast radius from automated remediation.