c4.13 Build advanced security automations
The cloud enables far more incident-response automation than on-premises, because the context needed to decide is available programmatically. Automate the highest-value responses — forensic capture and isolation of a compromised resource — to cut time-to-containment.
Implementation guidance
Why cloud makes this possible
In the cloud, the information an incident responder needs is available programmatically: the full API call log in AWS CloudTrail, the configuration inventory and change history in AWS Config, and Amazon EventBridge to trigger response flows on specific events. This enables a degree of automation far beyond what is practical on-premises.
Trigger automations from AWS Security Hub
AWS Security Hub is the primary source to drive these automations. It aggregates, correlates, and prioritizes findings from Amazon GuardDuty, Amazon Inspector, Amazon Macie, and Security Hub CSPM into a single stream, so you automate from one place instead of wiring each service separately. Use Security Hub automation rules to act on a finding by criticality and affected resource, and route findings through Amazon EventBridge to your own AWS Lambda or Step Functions remediations. This pairs with act on critical findings and automate critical playbooks.
Automate the highest-value responses
During an active incident, the time to gather forensic evidence and contain the threat directly drives the impact. Prioritize automating:
- Forensic capture of a compromised compute resource (for example snapshotting an EC2 instance's volumes and memory).
- Isolation of the resource (for example swapping to a quarantine security group that blocks egress while preserving it for investigation).
Test these automations thoroughly. If they require human approval, route it to multiple approvers with an SLA and escalation. If they run without approval, account for the asset's business process so automatic isolation does not cause more harm than the incident.
How to validate
- Do you have an automated way to capture forensic evidence from a compromised compute resource?
- Do you have an automated way to isolate a compromised resource?
- Have you tested these automations, and — if they need approval — is it routed to multiple approvers with an SLA and escalation?
- If they run without approval, is the asset’s business impact considered so isolation does not cause more harm than good?
Threats addressed
- During an active incident, slow manual forensic capture and containment lets an adversary do more damage; automation shortens time-to-containment and reduces impact.
AWS services
AWS Security Hub 
Amazon EventBridge 
AWS Lambda 
AWS Config