When to contact AWS Security Incident Response
You can contact AWS Security Incident Response for various purposes depending on your needs. The following table describes the different scenarios and the appropriate contact method for each.
Scenario |
When to Use |
Response Time |
Case Type |
|---|---|---|---|
Active Security Incident |
You are experiencing an urgent security incident requiring immediate incident response support and services |
15 minutes (first response) |
|
Investigation |
You have a perceived security incident and need support with log analysis and secondary confirmation of incident response investigation |
15 minutes (first response) |
|
Inquiries and Guidance |
You have questions about Amazon GuardDuty findings, suppression rules, alert triaging configurations, proactive response workflows, or general security posture related to AWS Security Incident Response capabilities |
15 minutes (first response) |
|
Onboarding Issues |
You are experiencing technical issues during the onboarding process for AWS Security Incident Response |
Varies by support plan |
For all AWS-supported cases (Active Security Incident and Investigations and Inquiries), AWS Security Incident Response engineers will respond within 15 minutes for the first response. This response time applies only to the initial contact and does not apply to subsequent responses.
