Check ID: guardduty_no_high_severity_findings
Provider: AWS
Service: guardduty
Severity: HIGH
Resource type: AwsGuardDutyDetector

​
What this check verifies

GuardDuty detectors are evaluated for the presence of High-severity findings. This surfaces whether any detector currently has findings labeled High by GuardDuty.

​
Risk

Unresolved High findings often signal active compromise, enabling:
  • Data exfiltration and unauthorized access (confidentiality)
  • Privilege escalation and tampering (integrity)
  • Disruption via malware/crypto-mining (availability)
Attackers can pivot laterally and persist if not contained.

​
Recommendation

Treat High findings as incidents.
  • Prioritize triage and containment; isolate affected resources, rotate secrets
  • Automate alerting and response with playbooks; integrate into IR
  • Enforce least privilege, network segmentation, and hardened baselines
  • Continuously tune detections and remove unused access to prevent recurrence

​
Remediation

Dashboard steps
  1. Sign in to the AWS console and open Amazon GuardDuty
  2. Use the Region selector to choose a Region where GuardDuty is enabled
  3. Go to Findings and filter: Severity = High (7-8.9), Archived status = Not archived
  4. Select all results, click Actions > Archive
  5. Repeat steps 2-4 for every Region with GuardDuty enabled
  6. Confirm there are 0 active High severity findings in each Region

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = guardduty_no_high_severity_findings. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks