Threat Reaction covers the full lifecycle — detection, classification, configuration, and response — without any third-party dependencies.
Full coverage of AWS GuardDuty finding types. Enable or disable individual finding types and assign a BLOCK or REPORT action to each. Changes take effect immediately across your AWS environment.
A sliding-window anomaly detector continuously evaluates S3 access patterns. Unusual spikes in object reads or cross-account access trigger findings without relying on GuardDuty's S3 protection tier.
Identifies early indicators of ransomware campaigns in your AWS environment: mass object encryption, unusual IAM credential use, and access pattern deviations that precede data destruction.
GuardDuty findings and S3 events are ingested via EventBridge and processed by a Python Lambda in near real-time. The result is a live event feed with full actor and resource context.
Every component is deployed into your own AWS account via a single CloudFormation template. No data ever leaves your perimeter. No vendor has access to your findings.
Access to the dashboard requires a Cognito account with mandatory TOTP MFA. Sessions are short-lived (5 minutes of inactivity). Self-signup is disabled — only admin-provisioned accounts can log in.
Each threat type can be individually tuned. Assign BLOCK for automated enforcement or REPORT for observation-only mode — giving you the flexibility to roll out responses incrementally.
A real-time events feed shows all processed findings with full context: actor details, resource identifiers, geographic location, severity, and timestamps.
Built entirely on AWS serverless primitives: Lambda, DynamoDB, API Gateway, and SQS. You pay only for actual usage. Idle time costs nothing.
All serverless. All in your account. One CloudFormation template.
Deploy Threat Reaction into your AWS account today and start reacting to threats — not incidents.
Get in Touch