Question

A security engineer manages GuardDuty for a production account. A vulnerability scanning tool the company owns runs weekly from an EC2 instance, generating recurring Recon:EC2/Portscan findings that are known and authorized. The security team wants to stop these specific benign findings from cluttering the console and from being forwarded to their SIEM via EventBridge, while ensuring GuardDuty continues to detect and report all other threats. What is the MOST appropriate action?

Accepted Answer

Create a suppression rule in GuardDuty using a filter that matches the finding type and the scanner instance ID so the findings are automatically archived.

Answer

Disable the Recon:EC2/Portscan finding type entirely across the GuardDuty detector.

Answer

Add the scanner instance's IP address to a GuardDuty threat list to exclude it from analysis.

Answer

Delete the GuardDuty detector and re-enable it after each weekly scan completes.