Question

A security engineer manages GuardDuty for a company. GuardDuty repeatedly generates 'Exfiltration:S3/AnomalousBehavior' and related S3 data-event findings for a specific S3 bucket that a nightly analytics job legitimately queries from an on-premises IP range. The engineer has confirmed the activity is benign and wants to stop these specific findings from cluttering the console and triggering downstream alerts, while continuing to receive all other GuardDuty findings normally. What is the MOST appropriate way to achieve this?

Accepted Answer

Create a GuardDuty suppression rule with filter criteria matching the finding type and the bucket/IP attributes, so matching findings are auto-archived but still recorded.

Answer

Disable GuardDuty S3 Protection for the entire account to stop the analytics-related findings.

Answer

Add the on-premises IP range to the GuardDuty trusted IP list to suppress all findings involving that address.

Answer

Create an EventBridge rule that deletes the findings from GuardDuty whenever they are generated.