# When to contact AWS Security Incident Response
<a name="when-to-contact-security-ir"></a>

 You can contact AWS Security Incident Response for various purposes depending on your needs. The following table describes the different scenarios and the appropriate contact method for each. 


| Scenario | When to Use | Response Time | Case Type | 
| --- | --- | --- | --- | 
| **Active Security Incident** | You are experiencing an urgent security incident requiring immediate incident response support and services | 15 minutes (first response) | [Active Security Incident](https://docs.aws.amazon.com/security-ir/latest/userguide/create-an-aws-supported-case.html) | 
| **Investigation** | You have a perceived security incident and need support with log analysis and secondary confirmation of incident response investigation | 15 minutes (first response) | [Investigations and Inquiries](https://docs.aws.amazon.com/security-ir/latest/userguide/create-an-aws-supported-case.html) | 
| **Inquiries and Guidance** | You have questions about Amazon GuardDuty findings, suppression rules, alert triaging configurations, proactive response workflows, or general security posture related to AWS Security Incident Response capabilities | 15 minutes (first response) | [Investigations and Inquiries](https://docs.aws.amazon.com/security-ir/latest/userguide/create-an-aws-supported-case.html) | 
| **Onboarding Issues** | You are experiencing technical issues during the onboarding process for AWS Security Incident Response | Varies by support plan | [AWS Support case](https://docs.aws.amazon.com/awssupport/latest/user/case-management.html#creating-a-support-case) | 

 For all AWS-supported cases (Active Security Incident and Investigations and Inquiries), AWS Security Incident Response engineers will respond within 15 minutes for the first response. This response time applies only to the initial contact and does not apply to subsequent responses.