Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
GuardDuty triage V-019
Triages GuardDuty findings against what Warden itself saw.
Checks
| Checks | Needs |
|---|---|
| Opens a case for each open GuardDuty finding of high or critical severity updated in the last day. | guardduty finding |
| Flags a severe GuardDuty finding that someone archived by hand. | guardduty finding, guardduty detector |
Coverage
Could not read anything this run
| eu-west-1 | |
|---|---|
‹sandbox› 345678901234 | Not read |
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
None mapped.
How to fix
GetTrailStatus / GetDetector confirm the state → restore via IaC; reversible