AWS First Steps
LanguageEnglish
New feature

GuardDuty Runtime Monitoring is now included in the AWS Security Hub Threat Analytics plan

Amazon GuardDuty Runtime Monitoring is now bundled with AWS Security Hub Threat Analytics plan, providing threat detection for Amazon EC2, Amazon EKS, and Amazon ECS on AWS Fargate through a single streamlined pricing model.

Today, AWS announced that Amazon GuardDuty Runtime Monitoring is now included with AWS Security Hub Threat Analytics plan. Runtime Monitoring inspects operating system, network, and file activity on Amazon EC2 instances, Amazon EKS clusters, and Amazon ECS tasks running on AWS Fargate, detecting threats such as container escape, privilege escalation, and crypto mining. Security Hub now bills this coverage at a simplified rate. For accounts and regions with Security Hub enabled, separate charges for GuardDuty Runtime Monitoring no longer apply, and its usage appears under AWS Security Hub. Detection coverage, finding types, and the GuardDuty security agent remain unchanged and require no reconfiguration. The free trial for the Threat Analytics plan is separate from the Security Hub Essentials plan free trial, and this change does not add a new free trial for Runtime Monitoring. Users can verify the billing impact of this change in AWS Cost Explorer or on the Security Hub usage page.

Why it matters

This change affects users of AWS security services, particularly those using both Security Hub and GuardDuty, simplifying billing and management through a streamlined pricing model.

Read the original AWS announcement

Related articles and terms

Threat Detection with Amazon GuardDuty - ML-Based Anomaly Detection and Incident ResponseLearn how GuardDuty detects threats, classifies findings, and integrates with Security Hub for incident response.Security Posture Management - Building a Unified Security Monitoring Foundation with AWS Security HubLearn about unified security monitoring with AWS Security Hub and automated threat detection through GuardDuty integration. This guide covers visualizing compliance with security best practices and security governance for multi-account environments.Amazon GuardDutyA machine learning-powered threat detection serviceAWS Security HubCentrally manage your AWS security posture and automatically check compliance with best practicesAWS Security Service Integration - Native Threat Detection from GuardDuty to Detective Without a SIEMWe explain the native threat detection mechanism through the integration of GuardDuty, Security Hub, Detective, and Macie, and compare the design philosophy differences with Azure Sentinel.