Review GuardDuty suppression as an alert-routing and detection decision

Automatically archiving a finding does not remove the activity that produced it.

Source facts

GuardDuty suppression rules automatically archive matching new findings. Suppressed findings are not forwarded to the integrations listed by AWS, and suppressed EC2 findings do not initiate Malware Protection scans. AWS also states that archived findings from suppression are unavailable as signals for Extended Threat Detection attack-sequence correlation.

Source: AWS Documentation.

Applicability

This concerns suppression-rule scope and downstream effects, rather than manually resolving an underlying threat.

DSE recommendation

DSE recommends creating narrow rules only after investigating repeatedly understood activity. Record the finding type, matching criteria, business owner and review date. Include the effect on downstream tickets, scanning and correlation in the approval. Avoid suppressing an entire service simply to reduce volume. Retain a method for reviewing archived matches and retire the rule when the expected activity ends. Treat an unexplained matching event as an investigation candidate rather than proof that the suppression remains appropriate. Record which investigation evidence remains available after the alert is archived and who will inspect it. Review broad service-level suppression proposals with the detection owner, using a written exception purpose and an expiry decision rather than a permanently open noise-reduction task.

Verification

Proposed verification: review the rule criteria against representative known findings, inspect archived matches and confirm intended downstream behavior in an approved test. Check the official integration and detection limitations before accepting broad criteria. Document who will revisit the exception and when.

Official reference

AWS Documentation. Reviewed October 20, 2026.