GDPatrol
A serverless SOAR framework for AWS GuardDuty that automatically executes configurable response actions based on security findings and threat severity.

GDPatrol
A serverless SOAR framework for AWS GuardDuty that automatically executes configurable response actions based on security findings and threat severity.
GDPatrol Description
GDPatrol is a serverless Security Orchestration Automation and Response (SOAR) framework designed specifically for AWS GuardDuty integration. The framework operates as a Lambda function that automatically receives GuardDuty findings through CloudWatch Event Rules and executes predefined response actions based on threat types and severity levels. The tool supports multiple automated response capabilities including IP blacklisting and whitelisting, domain blocking, EC2 instance quarantine and snapshot creation, account disabling, EC2 access control management, security group access modifications, and Auto Scaling Group instance detachment. All response actions are configurable through a config.json file, allowing organizations to customize their automated threat response workflows. GDPatrol integrates natively with AWS services and leverages serverless architecture to provide scalable, event-driven security automation without requiring dedicated infrastructure management. The framework processes GuardDuty findings in real-time and applies appropriate mitigation measures automatically, reducing manual intervention requirements for security teams.
FEATURED
Password manager with end-to-end encryption and identity protection features
VPN service providing encrypted internet connections and privacy protection
Fractional CISO services for B2B companies to accelerate sales and compliance
Stay Updated with Mandos Brief
Get the latest cybersecurity updates in your inbox
TRENDING CATEGORIES
POPULAR
Security platform that provides protection, monitoring and governance for enterprise generative AI applications and LLMs against various threats including prompt injection and data poisoning.
A threat intelligence aggregation service that consolidates and summarizes security updates from multiple sources to provide comprehensive cybersecurity situational awareness.
Fabric Platform is a cybersecurity reporting solution that automates and standardizes report generation, offering a private-cloud platform, open-source tools, and community-supported templates.
A weekly newsletter providing cybersecurity leadership insights, industry updates, and strategic guidance for security professionals advancing to management positions.