AWS security-ir documentation change
Summary
Updated communication workflow documentation to consolidate case management into Security Incident Response cases
Security assessment
The changes streamline communication processes but don't introduce new security features or address vulnerabilities. Terminology updates (ticket→case) don't impact security posture.
Diff
diff --git a/security-ir/latest/userguide/detect-and-analyze.md b/security-ir/latest/userguide/detect-and-analyze.md index 14d232a4d..3ccc6b318 100644 --- a//security-ir/latest/userguide/detect-and-analyze.md +++ b//security-ir/latest/userguide/detect-and-analyze.md @@ -56 +56 @@ You can raise a security event through the AWS Security Incident Response servic -AWS Security Incident Response keeps you informed during the investigation by engaging your security contacts through the event ticket. Multiple teammates may support your event, all using the event ticket for customer-provided content and AWS updates. +AWS Security Incident Response keeps you informed during the investigation by engaging your security contacts through the event case. Multiple teammates may support your event, all using the event ticket for customer-provided content and AWS updates. @@ -60,5 +60 @@ Communication may include automated notifications when a security alert is gener -AWS Security Incident Response uses two different cases types to communicate with you: Support for outbound communications to notify you of an event, and AWS Security Incident Response cases to communicate on a case you have opened to us. - -_AWS Support Cases:_ The service will use AWS Support Cases to communicate with your teams. We will create support cases on each AWS account in which the finding is generated. This approach facilitates communication with the multiple teams that own the specific workloads, as they will have more knowledge about the events occurring in their areas of responsibility. - -_AWS Security Incident Response Cases:_ If we determine that a finding needs to be escalated into a security incident, we will create a AWS Security Incident Response case. This ensures that critical security issues receive the appropriate level of attention and response. +The service will create AWS Security Incident Response cases to communicate with your teams. We will create cases against your membership account. This approach centralizes communication from all your accounts into a single place. The "[Proactive case]" prefix helps identify cases initiated by AWS Security Incident Response.