GuardDuty findings for a utilities account pile up in Security Hub while MTTR stays high because responders lack a standard triage path. Which improvement should the architects prioritize?
Select an answer to reveal the explanation.
Short Explanation
Findings without a playbook are smoke alarms with no fire drill. Security Hub gathers the smoke; runbooks tell who opens which door next. Shrink MTTR by rehearsing the path, not by silencing the detectors.
Full Explanation
GuardDuty findings piling up in Security Hub while MTTR stays high usually means responders lack a standard triage path for a utilities account. Publishing triage and remediation playbooks—runbooks or Automation—driven from Security Hub findings gives high-severity GuardDuty alerts a consistent response path with owners and steps. That improvement works because detection without playbooks becomes unread ticket noise; playbooks convert findings into repeatable municipal security operations. Muting all GuardDuty findings permanently to reduce fatigue fails by blinding the program to real threats. Deleting the Security Hub aggregator so each account is reviewed in isolation forever fails conceptually by destroying centralized prioritization across the org. Forwarding every finding to a public Slack channel without severity filtering or ownership fails confidentiality and triage discipline. Exam caveat: playbooks must distinguish true positives from expected utilities telemetry patterns; over-aggressive auto-remediation can interrupt SCADA-adjacent connectivity—approve destructive steps carefully. Operational check: write playbooks for the top three GuardDuty finding types, wire Security Hub custom actions or EventBridge to notify the right queue, exercise one finding end-to-end, and track MTTR weekly.