{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/review-guardduty-suppression-as-an-alert-routing-and-detection-decision/", "item": { "id": "https://update.dsesecurity.com/updates/review-guardduty-suppression-as-an-alert-routing-and-detection-decision/", "slug": "review-guardduty-suppression-as-an-alert-routing-and-detection-decision", "url": "https://update.dsesecurity.com/updates/review-guardduty-suppression-as-an-alert-routing-and-detection-decision/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/review-guardduty-suppression-as-an-alert-routing-and-detection-decision.md", "json": "https://update.dsesecurity.com/api/v1/posts/review-guardduty-suppression-as-an-alert-routing-and-detection-decision/" }, "title": "Review GuardDuty suppression as an alert-routing and detection decision", "summary": "Automatically archiving a finding does not remove the activity that produced it.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:13:47+00:00", "modified_at": "2026-10-20T18:34:29+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 246, "potentially_affected": "This concerns suppression-rule scope and downstream effects, rather than manually resolving an underlying threat.", "dse_recommendation": "DSE recommends creating narrow rules only after investigating repeatedly understood activity.", "primary_source": { "name": "AWS Documentation", "url": "https://docs.aws.amazon.com/guardduty/latest/ug/findings_suppression-rule.html", "published_on": null, "authority": "docs.aws.amazon.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Automatically archiving a finding does not remove the activity that produced it.

\n

Source facts

\n

GuardDuty suppression rules automatically archive matching new findings. Suppressed findings are not forwarded to the integrations listed by AWS, and suppressed EC2 findings do not initiate Malware Protection scans. AWS also states that archived findings from suppression are unavailable as signals for Extended Threat Detection attack-sequence correlation.

\n

Source: AWS Documentation.

\n

Applicability

\n

This concerns suppression-rule scope and downstream effects, rather than manually resolving an underlying threat.

\n

DSE recommendation

\n

DSE recommends creating narrow rules only after investigating repeatedly understood activity. Record the finding type, matching criteria, business owner and review date. Include the effect on downstream tickets, scanning and correlation in the approval. Avoid suppressing an entire service simply to reduce volume. Retain a method for reviewing archived matches and retire the rule when the expected activity ends. Treat an unexplained matching event as an investigation candidate rather than proof that the suppression remains appropriate. Record which investigation evidence remains available after the alert is archived and who will inspect it. Review broad service-level suppression proposals with the detection owner, using a written exception purpose and an expiry decision rather than a permanently open noise-reduction task.

\n

Verification

\n

Proposed verification: review the rule criteria against representative known findings, inspect archived matches and confirm intended downstream behavior in an approved test. Check the official integration and detection limitations before accepting broad criteria. Document who will revisit the exception and when.

\n

Official reference

\n

AWS Documentation. Reviewed October 20, 2026.

", "content_text": "Automatically archiving a finding does not remove the activity that produced it.\nSource facts\nGuardDuty suppression rules automatically archive matching new findings. Suppressed findings are not forwarded to the integrations listed by AWS, and suppressed EC2 findings do not initiate Malware Protection scans. AWS also states that archived findings from suppression are unavailable as signals for Extended Threat Detection attack-sequence correlation.\nSource: AWS Documentation.\nApplicability\nThis concerns suppression-rule scope and downstream effects, rather than manually resolving an underlying threat.\nDSE recommendation\nDSE recommends creating narrow rules only after investigating repeatedly understood activity. Record the finding type, matching criteria, business owner and review date. Include the effect on downstream tickets, scanning and correlation in the approval. Avoid suppressing an entire service simply to reduce volume. Retain a method for reviewing archived matches and retire the rule when the expected activity ends. Treat an unexplained matching event as an investigation candidate rather than proof that the suppression remains appropriate. Record which investigation evidence remains available after the alert is archived and who will inspect it. Review broad service-level suppression proposals with the detection owner, using a written exception purpose and an expiry decision rather than a permanently open noise-reduction task.\nVerification\nProposed verification: review the rule criteria against representative known findings, inspect archived matches and confirm intended downstream behavior in an approved test. Check the official integration and detection limitations before accepting broad criteria. Document who will revisit the exception and when.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.", "content_markdown": "Automatically archiving a finding does not remove the activity that produced it.\n\n## Source facts\n\nGuardDuty suppression rules automatically archive matching new findings. Suppressed findings are not forwarded to the integrations listed by AWS, and suppressed EC2 findings do not initiate Malware Protection scans. AWS also states that archived findings from suppression are unavailable as signals for Extended Threat Detection attack-sequence correlation.\n\nSource: [AWS Documentation](https://docs.aws.amazon.com/guardduty/latest/ug/findings_suppression-rule.html).\n\n## Applicability\n\nThis concerns suppression-rule scope and downstream effects, rather than manually resolving an underlying threat.\n\n## DSE recommendation\n\nDSE recommends creating narrow rules only after investigating repeatedly understood activity. Record the finding type, matching criteria, business owner and review date. Include the effect on downstream tickets, scanning and correlation in the approval. Avoid suppressing an entire service simply to reduce volume. Retain a method for reviewing archived matches and retire the rule when the expected activity ends. Treat an unexplained matching event as an investigation candidate rather than proof that the suppression remains appropriate. Record which investigation evidence remains available after the alert is archived and who will inspect it. Review broad service-level suppression proposals with the detection owner, using a written exception purpose and an expiry decision rather than a permanently open noise-reduction task.\n\n## Verification\n\nProposed verification: review the rule criteria against representative known findings, inspect archived matches and confirm intended downstream behavior in an approved test. Check the official integration and detection limitations before accepting broad criteria. Document who will revisit the exception and when.\n\n## Official reference\n\n[AWS Documentation](https://docs.aws.amazon.com/guardduty/latest/ug/findings_suppression-rule.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/review-guardduty-suppression-as-an-alert-routing-and-detection-decision/", "url": "https://update.dsesecurity.com/updates/review-guardduty-suppression-as-an-alert-routing-and-detection-decision/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/review-guardduty-suppression-as-an-alert-routing-and-detection-decision/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Review GuardDuty suppression as an alert-routing and detection decision", "item": "https://update.dsesecurity.com/updates/review-guardduty-suppression-as-an-alert-routing-and-detection-decision/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/review-guardduty-suppression-as-an-alert-routing-and-detection-decision/#article", "identifier": "https://update.dsesecurity.com/updates/review-guardduty-suppression-as-an-alert-routing-and-detection-decision/", "url": "https://update.dsesecurity.com/updates/review-guardduty-suppression-as-an-alert-routing-and-detection-decision/", "headline": "Review GuardDuty suppression as an alert-routing and detection decision", "description": "Automatically archiving a finding does not remove the activity that produced it.", "abstract": "Automatically archiving a finding does not remove the activity that produced it.", "articleBody": "Automatically archiving a finding does not remove the activity that produced it.\nSource facts\nGuardDuty suppression rules automatically archive matching new findings. Suppressed findings are not forwarded to the integrations listed by AWS, and suppressed EC2 findings do not initiate Malware Protection scans. AWS also states that archived findings from suppression are unavailable as signals for Extended Threat Detection attack-sequence correlation.\nSource: AWS Documentation.\nApplicability\nThis concerns suppression-rule scope and downstream effects, rather than manually resolving an underlying threat.\nDSE recommendation\nDSE recommends creating narrow rules only after investigating repeatedly understood activity. Record the finding type, matching criteria, business owner and review date. Include the effect on downstream tickets, scanning and correlation in the approval. Avoid suppressing an entire service simply to reduce volume. Retain a method for reviewing archived matches and retire the rule when the expected activity ends. Treat an unexplained matching event as an investigation candidate rather than proof that the suppression remains appropriate. Record which investigation evidence remains available after the alert is archived and who will inspect it. Review broad service-level suppression proposals with the detection owner, using a written exception purpose and an expiry decision rather than a permanently open noise-reduction task.\nVerification\nProposed verification: review the rule criteria against representative known findings, inspect archived matches and confirm intended downstream behavior in an approved test. Check the official integration and detection limitations before accepting broad criteria. Document who will revisit the exception and when.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:13:47+00:00", "dateModified": "2026-10-20T18:34:29+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/review-guardduty-suppression-as-an-alert-routing-and-detection-decision/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/review-guardduty-suppression-as-an-alert-routing-and-detection-decision/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Review GuardDuty suppression as an alert-routing and detection decision" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 246, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "AWS Documentation", "url": "https://docs.aws.amazon.com/guardduty/latest/ug/findings_suppression-rule.html" } } ] } }