c1.14 Act on critical security findings

Centralize, correlate, and alert

Findings from your detective services — Amazon GuardDuty, AWS Security Hub CSPM security checks, IAM Access Analyzer, Amazon Inspector, Amazon Macie — are routed automatically to AWS Security Hub, which correlates and enriches them across accounts and Regions to surface and prioritize the real risks. Route the critical and high severity findings to a notification (EventBridge → Amazon SNS, or a Lambda integration to Slack/Teams). If you already run a SIEM, forward findings there and alert from it.

Naming note: since late 2025 there are two services. AWS Security Hub is the unified layer that correlates and prioritizes signals for response; AWS Security Hub CSPM (what used to be called "AWS Security Hub") does posture management and best-practice checks. CSPM findings flow into AWS Security Hub.

Someone must act

A detective control only improves your posture when a human or an automation actually investigates and remediates. Name the person or team responsible, train them, and — as a Quick Win — commit to acting on at least the critical/high findings as they arrive. Alerts should reach more than one person.

Know how to escalate a real incident

Teach the team to tell a risk (a finding to fix) from an active security incident (something happening now). For an active incident you can engage the AWS Customer Incident Response Team (CIRT) — free assistance during an active event — and, with Enterprise Support, your Technical Account Manager.

Findings you should act on immediately

• An abuse notification from AWS (your account is attacking others — likely compromised).
• An exposed access key (via notification or Trusted Advisor).
• A critical GuardDuty finding such as command-and-control or Tor traffic — see the GuardDuty finding types.