AWS security-ir documentation change
Summary
Updated terminology from 'CIRT' to 'Security Incident Response engineers' and revised automation document names (e.g., ContainEC2Reversible to ContainEC2Instance). Added clearer support form instructions and service name updates.
Security assessment
Changes involve terminology clarification and documentation improvements rather than addressing specific vulnerabilities. Updates to automation document names (e.g., removing 'Reversible') suggest refined containment procedures but lack explicit security vulnerability context.
Diff
diff --git a/security-ir/latest/userguide/document-history-for-the-aws-security-incident-response-user-guide.md b/security-ir/latest/userguide/document-history-for-the-aws-security-incident-response-user-guide.md index be30b87b6..b016c0cda 100644 --- a//security-ir/latest/userguide/document-history-for-the-aws-security-incident-response-user-guide.md +++ b//security-ir/latest/userguide/document-history-for-the-aws-security-incident-response-user-guide.md @@ -13 +13 @@ Communication Preferences | Created and Updated [Added Communications Preferenc -Onboarding Guide Addition and Updates | Created and Updated [Added onboarding guide including the following sections](https://docs.aws.amazon.com/security-ir/latest/userguide/onboarding-guide.html) Added [Enable Security Incident Response](https://docs.aws.amazon.com/security-ir/latest/userguide/deploy-configure.html)section. Added [Authorize CIRT to perform threat containment actions](https://docs.aws.amazon.com/security-ir/latest/userguide/authorize-cirt.html) section. Added [Post Deployment of Security Incident Response](https://docs.aws.amazon.com/security-ir/latest/userguide/post-deploy.html)section. Added [Update the Incident Response Team](https://docs.aws.amazon.com/security-ir/latest/userguide/support-case.html)section. Added [GuardDuty Findings and Suppression Rules](https://docs.aws.amazon.com/security-ir/latest/userguide/guard-duty.html)section. Added [Amazon EventBridge](https://docs.aws.amazon.com/security-ir/latest/userguide/amazon-eventbridge.html)section. Added [Integrations and External Tooling Workflow](https://docs.aws.amazon.com/security-ir/latest/userguide/integrations-external-tooling.html)section. Added [External Tooling Workflow](https://docs.aws.amazon.com/security-ir/latest/userguide/external-tooling.html) section. Added [Appendix A: Points of Contact](https://docs.aws.amazon.com/security-ir/latest/userguide/appendix.html)section. | November 12, 2025 +Onboarding Guide Addition and Updates | Created and Updated [Added onboarding guide including the following sections](https://docs.aws.amazon.com/security-ir/latest/userguide/onboarding-guide.html) Added [Enable Security Incident Response](https://docs.aws.amazon.com/security-ir/latest/userguide/deploy-configure.html)section. Added [Authorize Security Incident Response engineers to perform threat containment actions](https://docs.aws.amazon.com/security-ir/latest/userguide/authorize-security-incident-response.html) section. Added [Post Deployment of Security Incident Response](https://docs.aws.amazon.com/security-ir/latest/userguide/post-deploy.html)section. Added [Update the Incident Response Team](https://docs.aws.amazon.com/security-ir/latest/userguide/support-case.html)section. Added [GuardDuty Findings and Suppression Rules](https://docs.aws.amazon.com/security-ir/latest/userguide/guard-duty.html)section. Added [Amazon EventBridge](https://docs.aws.amazon.com/security-ir/latest/userguide/amazon-eventbridge.html)section. Added [Integrations and External Tooling Workflow](https://docs.aws.amazon.com/security-ir/latest/userguide/integrations-external-tooling.html)section. Added [External Tooling Workflow](https://docs.aws.amazon.com/security-ir/latest/userguide/external-tooling.html) section. Added [Appendix A: Points of Contact](https://docs.aws.amazon.com/security-ir/latest/userguide/appendix.html)section. | November 12, 2025 @@ -37 +37 @@ Updated: Updates from customer comments on docs. | Updated https://docs.aws.am -Updated: Updates from customer comments on docs. | Removed multiple duplicate AWS AWS in text. Fixed broken links on https://docs.aws.amazon.com/security-ir/latest/userguide/sir_tagging.html and https://docs.aws.amazon.com/security-ir/latest/userguide/service-name-info-in-cloudtrail.html . Updates to https://docs.aws.amazon.com/security-ir/latest/userguide/contain.html. Removed the > from first paragraph. Replaced AWSSupport-ContainEC2Reversible with AWSSupport-ContainEC2Instance. Replaced AWSSupport-ContainIAMReversible with AWSSupport-ContainIAMPrincipal. Replaced AWSSupport-ContainS3Reversible with AWSSupport-ContainS3Resource. Updated formatting on https://docs.aws.amazon.com/en_us/security-ir/latest/userguide/issues.html When telling customers to contact CIRT via a support ticket, https://docs.aws.amazon.com/security-ir/latest/userguide/understand-response-teams-and-support.html now provides options to select in the support forms. Removed CloudWatch Events and replaced with EventBridge on https://docs.aws.amazon.com/security-ir/latest/userguide/logging-and-events.html . Grammar updates on https://docs.aws.amazon.com/security-ir/latest/userguide/technique-access-containment.html . Removed publication date from https://docs.aws.amazon.com/security-ir/latest/userguide/security-incident-response-guide.html, replaced by updates in this table. | December 10, 2024 +Updated: Updates from customer comments on docs. | Removed multiple duplicate AWS AWS in text. Fixed broken links on https://docs.aws.amazon.com/security-ir/latest/userguide/sir_tagging.html and https://docs.aws.amazon.com/security-ir/latest/userguide/service-name-info-in-cloudtrail.html . Updates to https://docs.aws.amazon.com/security-ir/latest/userguide/contain.html. Removed the > from first paragraph. Replaced AWSSupport-ContainEC2Reversible with AWSSupport-ContainEC2Instance. Replaced AWSSupport-ContainIAMReversible with AWSSupport-ContainIAMPrincipal. Replaced AWSSupport-ContainS3Reversible with AWSSupport-ContainS3Resource. Updated formatting on https://docs.aws.amazon.com/en_us/security-ir/latest/userguide/issues.html When telling customers to contact security incident response via a support ticket, https://docs.aws.amazon.com/security-ir/latest/userguide/understand-response-teams-and-support.html now provides options to select in the support forms. Removed CloudWatch Events and replaced with EventBridge on https://docs.aws.amazon.com/security-ir/latest/userguide/logging-and-events.html . Grammar updates on https://docs.aws.amazon.com/security-ir/latest/userguide/technique-access-containment.html . Removed publication date from https://docs.aws.amazon.com/security-ir/latest/userguide/security-incident-response-guide.html, replaced by updates in this table. | December 10, 2024