Ravi Sir's Cards › AWS
Triage by severity
This revision card explains Triage by severity. It starts from the need that treating every LOW finding like an outage burns the team out. It describes prioritize HIGH/CRITICAL first. Suppress known lab noise with filters; never ignore CRITICAL crypto mining style findings. The how-to section covers how to create an EventBridge rule on GuardDuty findings with severity >= 7 to page on-call. An example on the card is on-call gets SNS only for high severity; LOW stays in the console dashboard.
Read card text
What this card says
Why do we need it?
Treating every LOW finding like an outage burns the team out.
What is it?
Prioritize HIGH/CRITICAL first. Suppress known lab noise with filters; never ignore CRITICAL crypto mining style findings.
CRITICAL first
How to do it
Create an EventBridge rule on GuardDuty findings with severity >= 7 to page on-call.
Example
On-call gets SNS only for high severity; LOW stays in the console dashboard.