AWS GuardDuty alert retriggered

Question

I am using AWS GuardDuty integration to Slack.
Integration works like this, Cloudwatch Event --> SNS --> Lambda --> Slack.

Last week I got an alert for one finding and I did take action on that. But today I got an alert for the same GuardDuty finding ID in Slack.
Why does it happen? Does GuardDuty sends alerts for the same finding after few days?

Answer

GuardDuty is a security service that continuously monitors your AWS accounts and workloads for malicious activity and unusual behavior. If GuardDuty detects a potential security issue, it generates a finding. Each finding is assigned a unique finding ID. If GuardDuty continues to detect the issue over time, it will send additional alerts with the same finding ID. This is done to keep you informed of any ongoing security issues and to provide you with the information you need to take corrective action. It is not uncommon for GuardDuty to send multiple alerts for the same finding, especially if the issue is not immediately resolved.

https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_findings.html

AWS GuardDuty alert retriggered

Contenido relevante