AWS has launched Security Incident Response, a new service leveraging automation to streamline security incident management by integrating with Amazon GuardDuty, AWS Security Hub, and third-party detection tools. It provides end-to-end support for incident preparation, response, and recovery, handling events like account takeovers and ransomware attacks. Key features include automated triaging, centralized management through APIs or the AWS Management Console, secure communication tools, case tracking, and performance metrics. The service offers 24/7 AWS CIRT support, self-service investigation tools, and third-party collaboration options. Organizations can onboard through a central account, enabling proactive response features to automate remediation and execute containment actions for faster resolutions.

‍