AWS security-ir documentation change
Summary
Updated terminology: replaced 'security threat alerts from Amazon GuardDuty and AWS Security Hub CSPM' with 'security alerts from Amazon GuardDuty and AWS Security Hub', and replaced 'Security Incident Response engineers' with 'AWS Security Incident Response Engineering (SIRE) team' and 'AWS SIRE'.
Security assessment
Changes are editorial updates to team naming and service references without addressing vulnerabilities or security weaknesses. No evidence of security incident remediation.
Diff
diff --git a/security-ir/latest/userguide/monitoring-and-investigation.md b/security-ir/latest/userguide/monitoring-and-investigation.md index 951f9c622..0ce83a8d6 100644 --- a//security-ir/latest/userguide/monitoring-and-investigation.md +++ b//security-ir/latest/userguide/monitoring-and-investigation.md @@ -7 +7 @@ -AWS Security Incident Response reviews and triages security threat alerts from Amazon GuardDuty and AWS Security Hub CSPM, then configures suppression rules based on your environment to prevent unnecessary alerts. Security Incident Response engineers investigate findings and quickly escalates and guides your team to rapidly contain potential issues. If desired, you can grant AWS Security Incident Response permission to implement containment actions on your behalf. +AWS Security Incident Response reviews and triages security alerts from Amazon GuardDuty and AWS Security Hub, then configures suppression rules based on your environment to prevent unnecessary alerts. The AWS Security Incident Response Engineering (SIRE) team investigates findings and quickly escalates and guides your team to rapidly contain potential issues. If desired, you can grant AWS Security Incident Response permission to implement containment actions on your behalf. @@ -11 +11 @@ AWS Security Incident Response aligns to the NIST 800-61r2 [_Computer Security e -When the AWS Security Incident Response service identifies a security alert or you request security assistance, Security Incident Response engineers investigate. The team collects log events and service data such as GuardDuty alerts, triages and analyzes that data, performs remediation and containment activities, and provides post-incident reporting. +When the AWS Security Incident Response service identifies a security alert or you request security assistance, the AWS SIRE investigates. The team collects log events and service data such as GuardDuty alerts, triages and analyzes that data, performs remediation and containment activities, and provides post-incident reporting.