Hands-on playbook · 65 min
Amazon GuardDuty Playbook: Org-Wide Setup, Routing, Safe Tuning and Investigations
A hands-on GuardDuty deep dive: delegate an administrator in every Region, auto-enable protection plans, route findings with EventBridge, export to S3 with KMS, tune with suppression rules that keep attack sequences intact, watch Runtime Monitoring health, and work a credential exfiltration finding end to end.
- Delegate a GuardDuty administrator in every Region with one loop, and verify it
- Auto-enable protection plans for all members without the Runtime Monitoring conflict error
- Route High, Critical and attack sequence findings to the right people with EventBridge
- Write suppression rules that remove known noise without blinding Extended Threat Detection
- Export findings to S3 with KMS and bucket-owner checks for long-term retention
- Find and fix Runtime Monitoring agents that report Unhealthy
- Investigate InstanceCredentialExfiltration from finding to revoked sessions
- 01Under the hood
- 02Hands-on lab
- 03Recipes
- 04Investigating a credential exfiltration finding
- 05Rollout runbook
- 06Troubleshooting
- 07Interview drill
- 08Sources
Every worked answer in all 17 topics, every lesson in every course, the full concept curriculum, hands-on tool playbooks, the complete practice-test bank, and the downloadable security field guides.
6 months · One payment · No auto-renewal
An independent playbook for interview preparation and learning. AISecurityInterviews is not affiliated with or endorsed by Amazon Web Services, and product names are trademarks of their owners. Use these procedures only on systems you own or are authorised to test, and check the vendor's documentation before changing production.