Question

A security team has enabled Amazon GuardDuty across an AWS Organization with a delegated administrator account. A dedicated vulnerability scanning EC2 instance runs authorized port scans against internal subnets every night as part of the compliance program. GuardDuty repeatedly generates 'Recon:EC2/Portscan' findings for this instance, flooding the security team's ticketing queue and desensitizing analysts to genuine threats. The team wants to stop these specific benign findings from consuming analyst attention while ensuring the same finding type is still generated and investigated when it originates from ANY other instance. What is the MOST operationally efficient approach?

Accepted Answer

Create a GuardDuty suppression rule in the delegated administrator account that filters on the finding type 'Recon:EC2/Portscan' combined with the scanning instance's resource ID, so matching findings are auto-archived but still recorded.

Answer

Add the scanning instance's IP addresses to a GuardDuty trusted IP list so GuardDuty no longer evaluates traffic from that instance.

Answer

Disable the 'Recon:EC2/Portscan' finding type in the GuardDuty detector for the entire organization to eliminate the noise.

Answer

Create an EventBridge rule that matches all 'Recon:EC2/Portscan' findings and routes them to a Lambda function that deletes the tickets after creation.