Question

A security engineer manages a GuardDuty administrator account for 40 member accounts. A widely used vulnerability scanning vendor performs authorized port scans and reconnaissance against the company's EC2 fleet each night, generating hundreds of Recon:EC2/Portscan findings. The engineer wants to prevent these known-benign findings from appearing in the GuardDuty console and from being forwarded to Security Hub and downstream EventBridge automation, while still retaining the ability to review them later if needed. What is the most appropriate approach?

Accepted Answer

Create a suppression rule in GuardDuty using a filter that matches the finding type and the scanner's source IP addresses so matching findings are automatically archived.

Answer

Add the scanner's IP addresses to a trusted IP list in GuardDuty so that all activity from those IPs stops generating any findings.

Answer

Disable the Recon:EC2/Portscan finding type globally across the GuardDuty administrator and member accounts.

Answer

Create an EventBridge rule that matches the finding type and invokes a Lambda function to delete the findings from GuardDuty.