Question

A security engineer receives a GuardDuty finding of type UnauthorizedAccess:EC2/MaliciousIPCaller.Custom for a production EC2 instance. The organization requires that suspected compromised instances be automatically isolated for forensic investigation while preserving all volatile and non-volatile data, and while allowing forensic tooling in a separate account to access the evidence. Which automated response best meets these requirements?

Accepted Answer

Trigger an EventBridge rule on the GuardDuty finding that invokes a Lambda function to attach a forensic isolation security group with no rules to the instance, create snapshots of all EBS volumes and share them with the forensics account, and capture a memory dump via an SSM Run Command before any termination.

Answer

Configure EventBridge to invoke a Lambda function that immediately terminates the instance and deletes its EBS volumes, then emails the security team so they can rebuild from the latest AMI.

Answer

Enable Security Hub auto-remediation to stop the instance, detach its network interface, and move the finding to archived status so the on-call team can review it during business hours.

Answer

Create an EventBridge rule that triggers an SSM Automation runbook to reboot the instance, rotate its IAM role credentials, and apply the latest OS patches to remove the malware.