AWS Security Incident Response

1# yaml-language-server: $schema=../../schema/component.schema.json
2# AWS Security Incident Response: a managed service that ingests and triages security findings and
3# engages an AWS response team. "What is AWS Security Incident Response?": it generates no findings
4# of its own, ingests all Amazon GuardDuty and AWS Security Hub CSPM findings from the configured
5# sources, deduplicates and triages them, and escalates only validated concerns as proactive cases;
6# AWS-supported reactive cases carry a 15-minute initial response SLO. "Step 1: Enable and
7# configure": coverage is chosen for the whole organization or for selected OUs, never per account,
8# and containment actions are pre-authorized only after signup.
9schemaVersion: "1"
10type: "component"
11id: "aws-security-incident-response"
12kind: "monitoring"
13provider: "aws"
14docs: "https://docs.aws.amazon.com/security-ir/latest/userguide/what-is.html"
15defaults:
16  signal: "alerts"
17  collectorMode: "push"
18  alertGrouping: true
19  independentOfMonitored: false
20  managed: true
21properties:
22  guardDutyIngestion:
23    type: "boolean"
24    default: true
25  securityHubIngestion:
26    type: "boolean"
27    default: true
28  membershipScope:
29    type: "enum"
30    values: ["full-organization", "selected-ous"]
31  preAuthorizedContainment:
32    type: "boolean"
33    default: false
34  ec2Triage:
35    type: "boolean"
36    default: false
37  initialResponseSloMinutes:
38    type: "integer"
39    default: 15