[{"data":1,"prerenderedAt":88},["ShallowReactive",2],{"pattern-guardduty-file-modification-sfn-response-cdk":3,"pattern-group-guardduty-file-modification-sfn-response-cdk":87},{"id":4,"title":5,"architectureURL":6,"cleanup":7,"contributors":10,"deploy":12,"description":17,"extension":18,"framework":19,"gitHub":20,"highlight":6,"introBox":26,"language":32,"level":33,"meta":34,"patternArch":36,"patternGroup":6,"patternGroupLabel":6,"resources":68,"s3URL":6,"services":6,"stem":79,"testing":80,"videoId":6,"__hash__":86},"patterns\u002Fpatterns\u002Fguardduty-file-modification-sfn-response-cdk.json","Amazon GuardDuty Sensitive File Modification with AWS Step Functions Incident Response",null,{"text":8},[9],"\u003Ccode>npx cdk destroy\u003C\u002Fcode>",[11],"content\u002Fcontributors\u002Fnithin-chandran-r.json",{"text":13},[14,15,16],"\u003Ccode>cd guardduty-file-modification-sfn-response-cdk\u002Fcdk\u003C\u002Fcode>","\u003Ccode>npm install\u003C\u002Fcode>","\u003Ccode>npx cdk deploy\u003C\u002Fcode>","Detect sensitive file modifications with Amazon GuardDuty, classify severity, and auto-isolate compromised instances via AWS Step Functions and AWS Lambda","json","AWS CDK",{"template":21},{"repoURL":22,"templateURL":23,"projectFolder":24,"templateFile":25},"https:\u002F\u002Fgithub.com\u002Faws-samples\u002Fserverless-patterns\u002Ftree\u002Fmain\u002Fguardduty-file-modification-sfn-response-cdk","serverless-patterns\u002Fguardduty-file-modification-sfn-response-cdk","guardduty-file-modification-sfn-response-cdk","cdk\u002Flib\u002Fguardduty-file-modification-sfn-response-stack.ts",{"headline":27,"text":28},"How it works",[29,30,31],"Amazon GuardDuty detects sensitive file modifications or unauthorized access on Amazon EC2 instances and publishes findings to Amazon EventBridge.","Amazon EventBridge triggers an AWS Step Functions workflow that classifies finding severity: HIGH (≥7) isolates the instance, MEDIUM (4-6) notifies only, LOW (\u003C4) logs only.","For HIGH severity findings, AWS Lambda replaces the instance security group (network isolation), creates forensic EBS snapshots, and tags the instance. Amazon SNS delivers alerts to the security team.","TypeScript","300",{"patternType":35},"Serverless",{"icon1":37,"icon2":42,"icon3":46,"icon4":50,"icon5":55,"line1":59,"line2":62,"line3":64,"line4":66},{"x":38,"y":39,"service":40,"label":41},12,50,"guard-duty","Amazon GuardDuty",{"x":43,"y":39,"service":44,"label":45},40,"eventbridge","Amazon EventBridge",{"x":47,"y":39,"service":48,"label":49},67,"sfn","AWS Step Functions",{"x":51,"y":52,"service":53,"label":54},90,25,"lambda","AWS Lambda",{"x":51,"y":56,"service":57,"label":58},65,"sns","Amazon SNS",{"from":60,"to":61},"icon1","icon2",{"from":61,"to":63},"icon3",{"from":63,"to":65},"icon4",{"from":63,"to":67},"icon5",{"bullets":69},[70,73,76],{"text":71,"link":72},"Amazon GuardDuty Runtime Monitoring","https:\u002F\u002Fdocs.aws.amazon.com\u002Fguardduty\u002Flatest\u002Fug\u002Fruntime-monitoring.html",{"text":74,"link":75},"Automating incident response with Amazon EventBridge","https:\u002F\u002Fdocs.aws.amazon.com\u002Fguardduty\u002Flatest\u002Fug\u002Fguardduty_findings_cloudwatch.html",{"text":77,"link":78},"AWS Step Functions service integrations","https:\u002F\u002Fdocs.aws.amazon.com\u002Fstep-functions\u002Flatest\u002Fdg\u002Fconnect-supported-services.html","patterns\u002Fguardduty-file-modification-sfn-response-cdk",{"text":81},[82,83,84,85],"Generate sample Amazon GuardDuty findings using the create-sample-findings API.","Verify AWS Step Functions execution was triggered via the list-executions API.","For HIGH severity, confirm the instance security group was replaced and forensic snapshots were created.","Subscribe to the Amazon SNS topic to receive incident alerts.","bCx9jKLE6YrOPWjWo6Olwt6BJS486vxqNzUpISHVJ_M",[],1790246096277]