AWS security-ir documentation change
Summary
Added multiple document history entries for July 2026 updates including onboarding prerequisites rewrite, 'What is' page rewrite, detection services expansion, onboarding consolidation, and new configuration validation guide. Also added June 2026 entry for onboarding consolidation.
Security assessment
The changes document updates to security incident response processes and features, but there's no evidence of addressing specific vulnerabilities. The updates enhance security documentation by covering detection services, incident triage, and configuration validation.
Diff
diff --git a/security-ir/latest/userguide/document-history-for-the-aws-security-incident-response-user-guide.md b/security-ir/latest/userguide/document-history-for-the-aws-security-incident-response-user-guide.md index 69a6e6f13..7127567a4 100644 --- a//security-ir/latest/userguide/document-history-for-the-aws-security-incident-response-user-guide.md +++ b//security-ir/latest/userguide/document-history-for-the-aws-security-incident-response-user-guide.md @@ -12,0 +13,6 @@ Change| Description| Date +[Updated onboarding prerequisites with detection services and integration guidance](https://docs.aws.amazon.com/security-ir/latest/userguide/onboarding-prerequisites.html)| Rewrote the onboarding prerequisites page with expanded guidance on detection services (Amazon GuardDuty, AWS Security Hub CSPM, AWS CloudTrail), third-party EDR integration via Security Hub CSPM, and a note that findings created before onboarding are not retroactively ingested.| July 2, 2026 +[Rewrote the What is AWS Security Incident Response page](https://docs.aws.amazon.com/security-ir/latest/userguide/what-is.html)| Rewrote the What is page with updated content covering service overview, finding deduplication, log access, suppression rules, automated and human investigation, proactive and reactive cases, containment, integrations, and service boundaries.| July 2, 2026 +[Expanded the Updating Findings section on the Detect and Analyze page](https://docs.aws.amazon.com/security-ir/latest/userguide/detect-and-analyze.html)| Restructured the Detect and Analyze page to document the complete triage outcome taxonomy for Amazon GuardDuty findings, including categories for findings that are archived and findings that aren't archived. Relocated finding archiving content from the Detection section to the Updating Findings section.| July 2, 2026 +[Consolidated onboarding documentation](https://docs.aws.amazon.com/security-ir/latest/userguide/deploy-configure.html)| Rewrote the Enable AWS Security Incident Response page into a single streamlined guide covering prerequisites, membership account selection, account scope configuration, service permissions, and containment actions. Consolidated content from the Select a membership account, Setup membership details, and Associate accounts with AWS Organizations pages, which now redirect to the updated page.| July 2, 2026 +[Added configuration validation guide](https://docs.aws.amazon.com/security-ir/latest/userguide/config-validation.html)| Added a new topic with step-by-step procedures for validating AWS Security Incident Response configuration, including enrollment verification, detection source validation, automated pipeline testing, notification testing, containment readiness checks, and a troubleshooting guide.| July 2, 2026 +[Fixed CLI examples in Enable Security Incident Response using the API/CLI](https://docs.aws.amazon.com/security-ir/latest/userguide/enable-sir-using-cli.html)| Corrected the `create-membership` CLI examples by adding a missing comma delimiter between JSON objects in the `--incident-response-team` array and replacing the invalid `email` enum value in `communicationPreferences` with valid values.| July 1, 2026 @@ -15,0 +22 @@ Change| Description| Date +[Consolidated onboarding documentation](https://docs.aws.amazon.com/security-ir/latest/userguide/deploy-configure.html)| Rewrote the Enable AWS Security Incident Response page into a single streamlined guide covering prerequisites, membership account selection, account scope configuration, service permissions, and containment actions. Consolidated content from the Select a membership account, Setup membership details, and Associate accounts with AWS Organizations pages, which now redirect to the updated page.| June 17, 2026