Skip to content
TheCloud.Events

UpdateFindingsFeedback

AWS

UpdateFindingsFeedback

service: AWS - GuardDuty
tactics:
techniques:
tags:
AWS GuardDuty

Event

Updates the feedback status on GuardDuty findings, marking them as useful or not useful.

Security Context

  • UpdateFindingsFeedback submits a useful / not-useful signal on a finding to AWS. Contrary to a common assumption, it does not archive the finding, remove it from the console, or create a suppression rule — the finding remains visible and exportable in your account.
  • Because the action does not actually conceal anything, its value to an adversary is limited; the effective GuardDuty-evasion paths are suppression rules / filters (CreateFilter), ArchiveFindings, trusted-IP sets (CreateIPSet), or disabling the detector. Treat this event mainly as a weak signal of an actor probing the finding-management surface.

Log Source

CloudTrail

Sample Event

Adversarial. Draco marks two of his own findings as NOT_USEFUL — the GuardDuty Recon:IAMUser/UserPermissions and Persistence:IAMUser/AnomalousBehavior findings that fired earlier in the kill chain. Marking findings as NOT_USEFUL sends usefulness feedback to AWS; it does not archive them, remove them from the console, or suppress future findings — so the two findings remain visible to the SOC. T1685.

{
  "eventVersion": "1.09",
  "userIdentity": {
    "type": "IAMUser",
    "principalId": "AIDADRAC0MALF0YBADGY",
    "arn": "arn:aws:iam::555123456789:user/draco",
    "accountId": "555123456789",
    "accessKeyId": "ASIADRAC0MALF0YEXAMP5",
    "userName": "draco",
    "sessionContext": {
      "attributes": {
        "creationDate": "2026-04-15T18:51:02Z",
        "mfaAuthenticated": "false"
      }
    }
  },
  "eventTime": "2026-04-15T21:36:50Z",
  "eventSource": "guardduty.amazonaws.com",
  "eventName": "UpdateFindingsFeedback",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "203.0.113.66",
  "userAgent": "aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6",
  "requestParameters": {
    "detectorId": "abc12def34ghi56jkl78mno90pqrstu1",
    "findingIds": [
      "f2c0a4d4e5b6a7c8d9e0f1a2b3c4d5e6",
      "a3d1b5e5f6c7b8d9e0f1a2b3c4d5e6f7"
    ],
    "feedback": "NOT_USEFUL",
    "comments": "false positive — internal pentest"
  },
  "responseElements": null,
  "requestID": "90000000-0000-4000-8000-000111001000",
  "eventID": "90000000-0000-4000-8000-000111001001",
  "readOnly": false,
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "555123456789",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "guardduty.us-east-1.amazonaws.com"
  }
}
same service (AWS - GuardDuty)
ArchiveFindings CreateFilter CreateIPSet DeleteDetector DeleteMembers DisassociateFromMasterAccount DisassociateMembers StopMonitoringMembers +2 more