Question

A security team wants to fully automate the initial containment of any EC2 instance that GuardDuty flags with a high-severity finding. When a finding arrives, the workflow must: apply a quarantine security group, capture the instance's running memory and process list for later analysis, and record the actions in an audit trail — all without an analyst logging into the instance interactively. Which approach best meets these requirements?

Accepted Answer

Create an EventBridge rule matching GuardDuty high-severity findings that triggers a Lambda function; the function replaces the instance's security groups with an isolation group and invokes an AWS Systems Manager Run Command document that collects memory and process data via the SSM Agent, logging output to S3 and CloudWatch.

Answer

Enable GuardDuty Malware Protection so it automatically isolates the instance and streams a memory image to an S3 bucket, then review the scan results in the GuardDuty console.

Answer

Configure an EventBridge rule that opens an SSH session through EC2 Instance Connect and runs a shell script to gather forensic data, then manually change the security group afterward.

Answer

Use AWS Config remediation actions tied to a GuardDuty-based Config rule to attach an isolation security group, and rely on VPC Flow Logs to reconstruct the process activity.