Automation AWS-GuardDuty findings
Get an SNS alert for High Severity GuardDuty findings
Problem: Getting notified when there is Red finding in AWS GuardDuty.
Functionality: Solution is to trigger the CloudWatch event and send SNS to user when there is any findings with severity of greater than 7 in Guardduty.
Architecture diagram
How to Run the Script : Create a Lambda function called "GuardDutyAlert" the run-time version Python 3.6 or above by using the attach code. Creation of the Lambda function will in turn create CloudWatch Logs groups for its logging. Lamda can be call every 5 mins or as per your business requirement.
Prerequisite: GuardDuty must be enabled on your account