Autonomous Cloud Defense

AWS EventBridge & Cloud Auto-Remediation

Connect AWS security events to automated containment playbooks. Contain compromised credentials, isolate compromised instances, and roll back open firewall rules in seconds.

Event-driven response

React to GuardDuty, Security Hub, and CloudTrail events in near real-time without polling cloud APIs.

Safe containment playbooks

Execute surgical mitigations: revoke active IAM sessions, isolate EC2 hosts with security groups, and block public S3 buckets.

Audit trail and evidence

Every automated containment action generates an immutable audit record linking the incident trigger to the exact CLI and API actions taken.

Architecture & Setup

  • 1. Configure EventBridge Rule: Set up an AWS EventBridge Rule matching high-priority findings from AWS GuardDuty or Security Hub.
  • 2. Set API Destination: Point EventBridge to BlackShield's HTTPS webhook endpoint with an API Key header for cryptographic authentication.
  • 3. Synthesize Remediation Plan: When an event arrives, BlackShield maps the incident to MITRE ATT&CK techniques and constructs ordered containment steps.
  • 4. Execution Mode: Choose between advisory mode (review containment plans in the SOC console before clicking execute) or autonomous mode (instant automated mitigation).

EventBridge API Destination Payload

{
  "version": "0",
  "id": "e29202ca-8fe4-4f51-b0db-6f5dfa6b29ef",
  "detail-type": "GuardDuty Finding",
  "source": "aws.guardduty",
  "account": "123456789012",
  "time": "2026-10-11T12:00:00Z",
  "region": "us-east-1",
  "detail": {
    "severity": 8.0,
    "type": "UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration",
    "resource": {
      "resourceType": "AccessKey",
      "accessKeyDetails": {
        "accessKeyId": "ASIAEXAMPLEKEY",
        "userName": "contractor-dev"
      }
    }
  }
}

Supported Containment Actions

IAM Credential Revocation

Immediately invalidates active STS sessions and attaches an inline deny policy to compromised principals.

EC2 & Container Isolation

Replaces existing security groups with an isolated forensic quarantine group to halt command-and-control egress.

Ingress Rule Rollback

Automatically revokes unapproved 0.0.0.0/0 inbound SSH, RDP, or database ports flagged by Security Hub.

S3 Public Block Enforcement

Applies S3 PublicAccessBlock to buckets accidentally made public or modified by unauthorized principals.

Verification & Readiness Checks

  • ✔ EventBridge Rule DLQ is configured to retain events during network retries.
  • ✔ Cloud IAM role has least-privilege containment policies attached.
  • ✔ Simulation scenarios in the SOC Remediation Workbench execute with verified audit trails.
AWS EventBridge & Cloud Auto-Remediation