Detection and response on AWS

This hub currently holds one lesson: automated remediation with EventBridge and Lambda, the pattern for turning a detection into a closed gap rather than a ticket that sits open. CPS 234 wants evidence that findings get fixed, not just found, and auto-remediation is how you produce that evidence at scale — a finding fires an event, a fix runs, and the execution history is the proof. Done carelessly, the same automation breaks production at 2am, so the lesson covers the safe pattern and, just as importantly, what to never auto-fix.

GuardDuty and Security Hub coverage — the detection side that feeds this pipeline — will land here as those lessons are written. The relationship between the two matters: GuardDuty and other AWS services generate findings continuously, Security Hub aggregates and correlates them, and remediation is what closes the loop those tools open. For now this hub is one deep lesson on the response half of detection and response, not yet the full picture the title promises.