Back to Checks
aws

GuardDuty detector has no high severity findings

guardduty_no_high_severity_findings
Service: guarddutySeverity: high
OfficialBuilt-inVerified
Resource Type:AwsGuardDutyDetector

GuardDuty detectors are evaluated for the presence of High-severity findings. This surfaces whether any detector currently has findings labeled High by GuardDuty.

Prowler logoProwlerprowler-provider-aws

Risk

Unresolved High findings often signal active compromise, enabling:

  • Data exfiltration and unauthorized access (confidentiality)
  • Privilege escalation and tampering (integrity)
  • Disruption via malware/crypto-mining (availability)

Attackers can pivot laterally and persist if not contained.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks guardduty_no_high_severity_findings

Recommendation

Treat High findings as incidents.

  • Prioritize triage and containment; isolate affected resources, rotate secrets
  • Automate alerting and response with playbooks; integrate into IR
  • Enforce least privilege, network segmentation, and hardened baselines
  • Continuously tune detections and remove unused access to prevent recurrence

Remediation

Other

1Sign in to the AWS console and open Amazon GuardDuty
2Use the Region selector to choose a Region where GuardDuty is enabled
3Go to Findings and filter: Severity = High (7-8.9), Archived status = Not archived
4Select all results, click Actions > Archive
5Repeat steps 2-4 for every Region with GuardDuty enabled
6Confirm there are 0 active High severity findings in each Region

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.guardduty.guardduty_client import guardduty_client


class guardduty_no_high_severity_findings(Check):
    def execute(self):
        findings = []
        for detector in guardduty_client.detectors:
            if detector.id and detector.enabled_in_account:
                report = Check_Report_AWS(metadata=self.metadata(), resource=detector)
                report.status = "PASS"
                report.status_extended = f"GuardDuty detector {detector.id} does not have high severity findings."
                if len(detector.findings) > 0:
                    report.status = "FAIL"
                    report.status_extended = f"GuardDuty detector {detector.id} has {str(len(detector.findings))} high severity findings."

                findings.append(report)

        return findings

References