c6.8 Automate response to AI application security events

Turn detections into automatic action

Logging and alerting tell you something happened; automated response does something about it before a human wakes up. For an AI application, the events worth reacting to are things like a spike in guardrail blocks, GuardDuty findings on the app's compute, a burst of failed auth, or anomalous invocation volume from one principal. Amazon EventBridge is the hub: security services emit events to it, and you write rules that route matching events to a response target (Lambda, SSM Automation, Step Functions, SNS).

Match the events that matter

An EventBridge rule filters on an event pattern — here, high-severity GuardDuty findings (severity 7+):

{
  "source": ["aws.guardduty"],
  "detail-type": ["GuardDuty Finding"],
  "detail": { "severity": [ { "numeric": [">=", 7] } ] }
}

Create the rule and attach a response function as its target:

aws events put-rule \
  --name "ai-app-high-severity-response" \
  --event-pattern file://pattern.json

aws events put-targets \
  --rule "ai-app-high-severity-response" \
  --targets 'Id=1,Arn=arn:aws:lambda:us-east-1:111122223333:function:AutoRespond'

Make the response proportionate and reversible

The target should take a bounded, well-understood action — for example: disable a leaked application credential (rotate the Secrets Manager secret), revoke a session, isolate a compromised task's security group, or raise a ticket and page on-call. Prefer contain-then-notify over destructive automation: quarantine the resource and open a case rather than terminating things outright, so an automated response can't itself become an outage.

Keep the responder least-privileged and audited

The response Lambda/automation runs with its own role — scope it to just the containment actions it performs, and log every automated action (what fired, what it did) so the response is itself auditable. Combine with the attributed audit-log control so you can reconstruct the full detect → respond timeline.

Naming note: replace the account id and function ARN, and tune the severity threshold. Start the automation in a notify-only mode and review what it would have done before enabling active containment.