AWS First Steps
New feature

Amazon GuardDuty adds optional threat detection rules

Amazon GuardDuty now offers custom detection rules with 35 prebuilt options for CloudTrail management events, expanding threat detection coverage without log ingestion or storage

Amazon GuardDuty now offers custom detection rules, providing 35 pre-built rules for CloudTrail management events to extend threat detection for your environment. These rules generate 26 unique detection types mapped to 10 MITRE ATT&CK tactics without requiring log collection, normalization, or storage. Because certain threat techniques like external AMI sharing or disabling flow logs may be routine in some accounts but problematic in others, custom rules can be enabled only for unexpected activity. Accessible via the GuardDuty console or API, they can be tested in dry-run mode before live deployment and are available in all AWS commercial and AWS GovCloud (US) regions.

Why it matters

Amazon GuardDuty is a security service that detects malicious and unauthorized behavior, and this update allows organizations to customize their detection scope

Read the original AWS announcement

Related articles and terms

Threat Detection with Amazon GuardDuty - ML-Based Anomaly Detection and Incident ResponseLearn how GuardDuty detects threats, classifies findings, and integrates with Security Hub for incident response.Amazon GuardDutyA managed threat detection service that uses machine learning and threat intelligence to continuously monitor and detect threats across AWS accounts and workloadsAWS Security Service Integration - Native Threat Detection from GuardDuty to Detective Without a SIEMWe explain the native threat detection mechanism through the integration of GuardDuty, Security Hub, Detective, and Macie, and compare the design philosophy differences with Azure Sentinel.Vulnerability Assessment and Threat Detection - Continuous Security Monitoring with Amazon Inspector and GuardDutyLearn how to design and operate vulnerability assessment and threat detection using Amazon Inspector and Amazon GuardDuty.Data Privacy Protection - Automated Sensitive Data Discovery and Threat Defense with Amazon Macie and GuardDutyLearn practical data privacy protection techniques combining Amazon Macie's automated sensitive data discovery in S3 with Amazon GuardDuty's threat intelligence. This article covers comprehensive security measures from identifying personal information to real-time threat detection.