aws-gd-update-findings-feedback

Mark GuardDuty findings as FALSE_POSITIVE to bypass SOAR automation, poison the ML model, and reduce SOC visibility.

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`SecurityService`
source	`?principal`
target	`?detector`
permissions	`guardduty:UpdateFindingsFeedback`
conditions	`iam_permission`
state logic	ACTIVE when ?principal holds effective guardduty:UpdateFindingsFeedback. BLOCKED if an SCP denies guardduty:UpdateFindingsFeedback.

source type

Identity

target type

SecurityService

source

?principal

target

?detector

permissions

guardduty:UpdateFindingsFeedback

conditions

iam_permission

state logic

ACTIVE when ?principal holds effective guardduty:UpdateFindingsFeedback. BLOCKED if an SCP denies guardduty:UpdateFindingsFeedback.

Narrative

{principal.name} can mark GuardDuty findings from {detector.name} as FALSE_POSITIVE (guardduty:UpdateFindingsFeedback), potentially bypassing automated SOC playbooks that skip false-positive findings and potentially poisoning GuardDuty's machine-learning model with repeated false-positive feedback to suppress similar findings in future detections.

Raw rule rules/derived/aws/guardduty.yaml

id: aws-gd-update-findings-feedback
emits: CanModifyConfiguration
description: Mark GuardDuty findings as FALSE_POSITIVE to bypass SOAR automation, poison the ML model,
  and reduce SOC visibility.
match:
- - principal: null
  - HasPermission
  - detector: null
where:
- node_type(?detector) == SecurityService
- ?detector.provider_type == 'AWS::GuardDuty::Detector'
- ?principal has EFFECTIVE guardduty:UpdateFindingsFeedback on ?detector
emit:
  source_type: Identity
  target_type: SecurityService
  source: ?principal
  target: ?detector
  permissions:
  - guardduty:UpdateFindingsFeedback
  conditions:
  - iam_permission
  state_logic: ACTIVE when ?principal holds effective guardduty:UpdateFindingsFeedback. BLOCKED if an
    SCP denies guardduty:UpdateFindingsFeedback.
  confidence: 0.7
  derived_from:
  - HasPermission(?principal, guardduty:UpdateFindingsFeedback, ?detector)
  false_positive_note: 'Legitimate use: SOC analysts marking findings they have investigated and confirmed
    as false positives (benign scanner activity, known test traffic). The evasion value is lower than
    deletion or suppression because the finding remains in the database (discoverable via API, audit logs,
    and Detective graphs) and an analyst reviewing feedback history will see the FALSE_POSITIVE mark.
    However, the operational impact is meaningful: automated SOAR playbooks configured to skip FALSE_POSITIVE
    findings will not respond, reducing mean-time-to-response (MTTR). Additionally, repeated false-positive
    feedback on similar finding types can affect GuardDuty''s ML model, reducing alert volume for that
    finding class in the future (even for legitimate similar activity). Confidence is 0.70 (lower than
    deletion/disable/suppression) because the suppression is behavioral and reversible, and an analyst
    with access to feedback history can recover the truth. Not a privilege-escalation path.'
  narrative: '{principal.name} can mark GuardDuty findings from {detector.name} as FALSE_POSITIVE (guardduty:UpdateFindingsFeedback),
    potentially bypassing automated SOC playbooks that skip false-positive findings and potentially poisoning
    GuardDuty''s machine-learning model with repeated false-positive feedback to suppress similar findings
    in future detections.'