One sandbox instance, walked through a realistic kill chain: reconnaissance, a command-and-control lookup, crypto-mining, and finally credential exfiltration. Watch the responder escalate — logging low-severity events, showing its intended action in dry-run, then isolating the instance once armed.
When Amazon GuardDuty raises a security finding above a severity threshold, an EventBridge rule routes it to a Lambda that records the finding and, for instances on an allowlist, isolates them by swapping their security groups for a deny-all quarantine group. The instance stays alive for forensics rather than being terminated.
The responder ships in dry-run by default — it logs the exact
action it would take without performing it. An automation that can quarantine
compute is dangerous if it misfires, so it is inert until deliberately armed,
and even when armed only acts on instances tagged as lab targets.
The findings shown are captured from a real GuardDuty detector run against a sandbox instance, paired with the responder's actual decision for each. The page is static — it keeps working with no infrastructure running and at zero cost. The attacks are synthetic; no real patient or production system was involved.