Unified Threat Detection on AWS
Security Hub, GuardDuty, and a Step Functions pipeline that isolates a compromised EC2 instance within seconds of a HIGH finding, no human required.
GuardDuty findings sat in a dashboard until a human noticed them: no ticket, no isolation, no page. The first EventBridge rule, without a ProductName filter, matched every HIGH finding including routine FSBP compliance checks, firing eight Step Functions executions in ten minutes that re-isolated an already-isolated instance and overwrote its restore tag.
Security Hub normalizes GuardDuty findings so EventBridge can filter precisely on ProductName, resource type, and workflow state. A five-state Step Functions machine parses the finding, retrieves a pre-created isolation security group, swaps it onto the instance while tagging the original for rollback, and notifies over SNS. Swapping security groups instead of stopping the instance keeps it running for forensics and makes the whole action reversible with one CLI command.
A finding that sits in a dashboard until someone notices it isn't a response, it's a log.
A HIGH crypto-miner finding against the target EC2 triggered isolation within 30 seconds of landing in Security Hub: the security group swapped from target to isolation with zero inbound and zero outbound rules, and the SNS alert arrived carrying the exact restore command.
- Step Functions graph: parse finding, get or create isolation SG, swap SGs, notify
- ProductName: GuardDuty filter added after FSBP compliance checks falsely triggered isolation
- SG swap keeps the instance running for forensics, reversible via the tagged OriginalSGs