Lion Cipher Lab

Auto-respond to GuardDuty findings with EventBridge (alert now, contain with a human in the loop)

• Cloud Security
• Intermediate
• ~60 min
• Free · no account required

Why it matters

Detection without response is just a louder way to get breached. A GuardDuty finding that lands in a console nobody watches -- or in an inbox already drowning in noise -- does not protect anything; the value is created in the seconds AFTER a finding, when something actually happens. This lab builds that 'something': an event-driven pipeline that catches a GuardDuty finding the moment it is published, decides whether it is serious enough to matter, and fires an automatic response -- at minimum an alert that reaches a human fast, and optionally a contain action. That is the core of a modern…

What you'll learn

• closing the loop from detection to action: turning a GuardDuty finding into an automatic response instead of an alert nobody reads
• what Amazon EventBridge is -- the event bus, rules, event patterns, and targets -- and why event-driven routing beats polling an API on a timer
• writing an EventBridge event pattern that matches GuardDuty findings and filters on detail.severity with a numeric threshold
• wiring an SNS topic + confirmed email subscription as an EventBridge target so a finding reaches a human in seconds
• adding a Lambda function as a second target -- the stub of an auto-contain action -- and giving it a least-privilege IAM execution role
• proving the whole pipeline end to end by generating a real GuardDuty SAMPLE finding and watching the email arrive
• the judgment call: WHEN to auto-alert vs auto-contain, severity thresholds, idempotency, and the human-in-the-loop rule for destructive actions
• cleaning up every resource (rule, topic, subscription, function, role) so nothing lingers or bills

Steps in this lab

1. Read this first: your own account, sample findings only, delete it all at the end
2. The idea: detection is only half the loop
3. What EventBridge is -- and why event-driven beats polling
4. Build the alert target first: an SNS topic with a confirmed email subscription
5. Let EventBridge publish to the topic (the topic access policy)
6. Write the EventBridge rule: match GuardDuty findings, and filter on severity
7. Attach the SNS topic as the rule's first target
8. Add a Lambda stub as the second target -- and give it a least-privilege role
9. The judgment: when to auto-alert, when to auto-contain, when to ask a human
10. Prove it end to end with a real SAMPLE finding
11. Clean up: delete every resource so nothing lingers or bills
12. What you just built -- and where it goes next

Open the full interactive lab →