Events
The Events page is a paginated, time-ordered log of every security event processed by Threat Reaction. It includes both native GuardDuty findings ingested via EventBridge and custom anomaly events generated by the S3 sliding-window detector.
In the app: /events
Event Table
Each row in the table shows: the UTC timestamp, the finding type identifier, a color-coded severity badge (Critical / High / Medium / Low), the actor summary (source IP or IAM principal), and a short description. Events are sorted newest-first. The table is paginated at 25 rows per page.
Expanding an Event
Click any row to expand its detail card. The expanded view shows:
- Actor Summary — source IP address, geographic country, ISP, user agent (where available), and the IAM principal (role, user, or access key).
- Resource Details — the AWS resource targeted: S3 bucket name, EC2 instance ID, IAM role ARN, or other resource identifier.
- Description — the full description text from GuardDuty, or for S3 anomaly events, the operation type, count, and total bytes transferred.
Pagination
Use the Previous and Next buttons at the bottom of the table to navigate between pages of 25 events. The system uses DynamoDB cursor-based pagination, meaning pages are not numbered — you navigate forward and backward through a chronological cursor. Very old events may no longer appear if TTL has expired them.
GuardDuty Events
Native GuardDuty findings are labeled with the GuardDuty service badge. They include the full finding metadata: finding ID, account ID, region, resource ARN, and the actor who triggered the finding. The finding ID can be used to look up the original finding in the GuardDuty console for deeper analysis.
S3 Anomaly Events
Events generated by the ThreatReaction sliding-window detector are labeled with the ThreatReaction service badge. They include the operation type (GetObject, PutObject, DeleteObject, ListObjects), the actor (IP or IAM principal), the number of operations in the detection window, and the total bytes transferred. These events indicate that an entity's S3 activity exceeded the anomaly threshold for the registered bucket.
Event Retention
Events are stored in DynamoDB with a TTL (time-to-live). By default, events expire after 90 days. This keeps storage costs low while retaining enough history for incident response and trend analysis. If you need longer retention, export findings to S3 using the SAVE action on the Threats page.
Refreshing Events
The Refresh button in the app header reloads the current page of events from DynamoDB. Threat Reaction does not auto-poll — use Refresh to check for new activity since you last loaded the page.
💡 Tip
If you see a high volume of events from a single actor IP over a short time window, navigate to the Threats page and switch the relevant finding type to BLOCK. The actor will be added to the WAF blocklist on the next matching finding.
ℹ️ Note
GuardDuty delivers findings to EventBridge within 5 minutes of detection by default. High-severity findings can be configured for near-real-time delivery in the GuardDuty console. Threat Reaction writes events to DynamoDB immediately upon Lambda invocation.
⚠️ Warning
Events from before the Threat Reaction stack was deployed will not appear here. The system only processes findings that EventBridge routes to it after the stack is active. To ingest historical findings, use the GuardDuty 'Export findings' feature and import them manually.