# Ensure GuardDuty Untreated Findings Check

- Source: https://support.icompaas.com/support/solutions/articles/62000228265-ensure-guardduty-untreated-findings-check
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

## **Description:**

Amazon GuardDuty is a regional-based intelligent threat detection service that monitors for malicious activity and unauthorized behavior to protect your AWS accounts, workloads, and data stored in Amazon S3.

The service itself is powered by machine learning, and this allows the service to continuously evolve by learning and understanding operational behavior within your infrastructure.

## **Rationale:**

GuardDuty Untreated Findings check means to check whether Amazon GuardDuty has findings that are not archived, so for this we need to set the rule in AWS configuration. We need to check if Amazon GuardDuty has non-archived or findings that are older than the specified number of days in the NON\_COMPLIANT rule.

## **Impact:**

Amazon GuardDuty monitors your AWS accounts, workloads, and data stored in Amazon S3. If you find out about the untreated GuardDuty Findings that are not able to deliver security detail to the GuardDuty console and Amazon CloudWatch Events, then you will be able to know about the security finding that works and alerts when any malicious or unauthorized behavior happens, and we will be able to understand its detection techniques or algorithms that are working.

## **Default Value:**

The number of days Amazon GuardDuty low severity findings are allowed to stay non-archived is: The default is 30 days. 

By default, in AWS Config, the guardduty non-archived-findings rule is not enabled.

## **Pre-Requisite:**

This policy implemeted when you already enabled the GuardDuty and it contain findings.

You also enable the AWS Config enable to check GuardDuty Findings untreated.

## **Remediation:**

### **Test plan:** 

-   AWS Console Process
    

**Step 1:** Sign in to the AWS Management Console and go to the AWS config dashboard at [https://console.aws.amazon.com/config/](https://console.aws.amazon.com/secretsmanager/ "https://console.aws.amazon.com/secretsmanager/").

**Step 2:** Click on **Rules** in the left navigation panel.

![](https://support.icompaas.com/assets/kb/18957adbcb263c42.png)

**Step 3:** In the rule we check rule exist or not “guardduty-non-archived-findings”

-   Using AWS CLI
    

**To get details for an AWS Config rule**

The following command returns details for an AWS Config rule named `guardduty non-archived-finding`:

`1aws configservice describe-config-rules \ 2--config-rule-names guardduty-non-archived-finding` 

### **Implementation Steps:**

-   AWS Console Process
    

**Step 1:** Sign in to the AWS Management Console and go to the AWS config dashboard at [https://console.aws.amazon.com/config/](https://console.aws.amazon.com/secretsmanager/ "https://console.aws.amazon.com/secretsmanager/").

**Step 2:** Click on **Rules** in the left navigation panel.

![](https://support.icompaas.com/assets/kb/ebcc46dc77d2c215.png)

**Step 3:** Click on **Add Rule** button.

![](https://support.icompaas.com/assets/kb/0b3f8eb90f5d7b4f.png)

**Step 4:** Select **Add AWS managed rule**.

  

![](https://support.icompaas.com/assets/kb/736862130de2e5c8.png)**Step 5:** Scroll down in AWS Managed Rules search “`guardduty-non-archived-finding`” and then select name`guardduty-non-archived-finding`  

  

![](https://support.icompaas.com/assets/kb/50c866678b1ffee6.png)

![](https://support.icompaas.com/assets/kb/6c44acf3d5a5e5e7.png)

**Step 6:** Click on **Next** button  

![](https://support.icompaas.com/assets/kb/c352c4933e11586c.png)

**Step 7:** In detail no need to change so click on **Next** button  

![](https://support.icompaas.com/assets/kb/db7370ddddbf4d5f.png)

**Using AWS CLI**

Add or updates the rules we use put-config-rule

**To add an AWS managed Config rule**

aws configservice put-config-rule \\  
\--config-rule file://RequiredTagsForSecretManager.json

**in the json file we write** 

{  
    "ConfigRuleName": "guardduty-non-archived-findings",  
    "Description": "A Config rule that checks whether the Amazon GuardDuty has findings that are non archived. The rule is NON\_COMPLIANT if Amazon GuardDuty has non archived low/medium/high severity findings older than the specified number in the daysLowSev/daysMediumSev/...",  
    "Source": {  
        "Owner": "AWS",  
        "SourceIdentifier": "GUARDDUTY\_NON\_ARCHIVED\_FINDINGS",  
        "SourceDetails": \[\]  
    },  
    "Scope": {  
        "ComplianceResourceTypes": \[\]  
    },  
    "InputParameters": "{\\"daysLowSev\\":\\"30\\",\\"daysMediumSev\\":\\"7\\",\\"daysHighSev\\":\\"1\\"}",  
    "MaximumExecutionFrequency": "TwentyFour\_Hours"  
}'

## **Backout Plan**

-   AWS Console Process
    

**Step 1:** Sign in to the AWS Management Console and go to AWS config dashboard at [https://console.aws.amazon.com/config/](https://console.aws.amazon.com/secretsmanager/ "https://console.aws.amazon.com/secretsmanager/").

**Step 2:** Click on **Rules** in the left Navigation panel

![](https://support.icompaas.com/assets/kb/5fab1ef9e9cffaa2.png)

**Step 3:** Select rules to delete or remove from AWS config then click on Action menu list.  

![](https://support.icompaas.com/assets/kb/649c01103611d489.png)

**Step 4:** Click on **Delete** rule.

![](https://support.icompaas.com/assets/kb/586f0bd2c4b46d09.png)

**Step 5:** For confirmation **type delete and click on delete button**  

![](https://support.icompaas.com/assets/kb/14391e3f8a258a0d.png)

### **Using AWS CLI**

**To delete an AWS Config rule.**

aws configservice delete-config-rules \\  
 --config-rule-names guardduty-non-archived-finding

## **Note:**

The rule is NON\_COMPLIANT if Amazon GuardDuty has non archived low/medium/high severity findings older than the specified number in the daysLowSev/daysMediumSev/`daysHighSev` parameter.

**Identifier:** GUARDDUTY\_NON\_ARCHIVED\_FINDINGS

**Trigger type:** Periodic

**AWS Region:** All supported **AWS regions except** Middle East (Bahrain), China (Beijing), Asia Pacific (Jakarta), Africa (Cape Town), Middle East (UAE), Asia Pacific (Hyderabad), Asia Pacific (Osaka), Europe (Milan), AWS GovCloud (US-East), Europe (Spain), China (Ningxia), Europe (Zurich) Region

## **Reference:**

1.  [https://aws.amazon.com/blogs/security/visualizing-amazon-guardduty-findings/](https://aws.amazon.com/blogs/security/visualizing-amazon-guardduty-findings/ "https://aws.amazon.com/blogs/security/visualizing-amazon-guardduty-findings/")
    
2.  [![](https://support.icompaas.com/assets/kb/4a1814821fa55725.png)guardduty-non-archived-findings - AWS Config](https://docs.aws.amazon.com/config/latest/developerguide/guardduty-non-archived-findings.html) 
    
3.  [![](https://support.icompaas.com/assets/kb/39e774a8f99ddf58.png)Understanding Amazon GuardDuty findings - Amazon GuardDuty](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_findings.html) 
    
4.  [![](https://support.icompaas.com/assets/kb/7a113e5f57ed9e1e.png)configservice — AWS CLI 1.27.102 Command Reference](https://docs.aws.amazon.com/cli/latest/reference/configservice/index.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.