GuardDuty Investigation の trigger-prompt を AWS CLI でいろいろ試してみた

aws --version

aws-cli/2.35.11 Python/3.14.6 Darwin/24.6.0 source/arm64

brew upgrade awscli

aws guardduty list-detectors --region ap-northeast-1

{
    "DetectorIds": [
        "<DETECTOR_ID>"
    ]
}

# Investigation を作成
aws guardduty create-investigation \
  --detector-id <DETECTOR_ID> \
  --trigger-prompt "Investigate finding <FINDING_ID>" \
  --region ap-northeast-1

{
    "InvestigationId": "12cf78d2-5f91-2917-704c-45de39789c54"
}

# 結果を確認（完了まで数分かかります）
aws guardduty get-investigation \
  --detector-id <DETECTOR_ID> \
  --investigation-id 12cf78d2-5f91-2917-704c-45de39789c54 \
  --region ap-northeast-1

aws guardduty list-investigations \
  --detector-id <DETECTOR_ID> \
  --region ap-northeast-1

aws guardduty create-investigation \
  --detector-id <DETECTOR_ID> \
  --trigger-prompt "Analyze findings in my account" \
  --region ap-northeast-1

{
    "Investigation": {
        "Status": "FAILED",
        "TriggerPrompt": "Analyze findings in my account",
        "Error": "Couldn't match this request to a supported action. Try asking about a GuardDuty finding ID, account security posture, or an organization-wide analysis."
    }
}

aws guardduty create-investigation \
  --detector-id <DETECTOR_ID> \
  --trigger-prompt "Analyze my account id: XXXXXXXXXXXX" \
  --region ap-northeast-1

"Investigate finding 1ab2cc3d4e5f6a7b8cc9dd0e1f2a3b4c5d6 in account 123456789012"
"Analyze findings in account with id 123456789012"
"Analyze findings in my organization"

aws guardduty create-investigation \
  --detector-id <DETECTOR_ID> \
  --trigger-prompt "Analyze findingId: abc1234def5678abc1234def56789012" \
  --region ap-northeast-1

{
    "Status": "COMPLETED",
    "RiskLevel": "Critical",
    "Confidence": "High",
    "Risk": "Single EC2 instance confirmed conducting sustained Tor-based C2 and cryptomining DNS activity within a 42-minute window; behavioral evidence independently supports Critical severity. Resource name pattern and known canary domain suggest possible GuardDuty tester-stack activity, but attacker-controllable names are not used to downgrade the assessment."
}

aws guardduty create-investigation \
  --detector-id <DETECTOR_ID> \
  --trigger-prompt "Investigate finding abc1234def5678abc1234def56789012. This instance is part of our GuardDuty tester stack used for testing. Please assess whether this is expected test behavior or a real threat." \
  --region ap-northeast-1

{
    "Status": "COMPLETED",
    "RiskLevel": "Critical",
    "Confidence": "High",
    "Risk": "Confirmed multi-stage EC2 compromise with Tor-based C2 (T1090.003) and cryptomining resource hijacking (T1496) on instance i-09c137c1ad29d4d6d, corroborated by independent network and DNS behavioral signals; both finding types are novel for this account baseline."
}

aws guardduty create-investigation \
  --detector-id <DETECTOR_ID> \
  --trigger-prompt "Investigate finding abc1234def5678abc1234def56789012. Focus on whether IAM credentials attached to this instance may have been compromised and what immediate containment actions are needed." \
  --region ap-northeast-1

{
    "Status": "COMPLETED",
    "RiskLevel": "High",
    "Confidence": "Medium",
    "Risk": "Real outbound Tor C2 traffic to three reputation-confirmed Tor IPs on a single EC2 instance with an attached IAM instance profile; the cryptomining Impact signal derives from a known GuardDuty canary/test domain, and EC2 Runtime Monitoring is disabled, limiting host-level corroboration"
}