Concise summaries of official AWS update announcements for Amazon GuardDuty.
Read the Amazon GuardDuty guide / Back to the latest updates
Information as of November 3, 2026.
Amazon GuardDuty now supports optional detection rules for Runtime Monitoring, enabling over 50 rules to detect process, file, and network activity that may be routine in one environment but indicate compromise in another, such as modifying sudoers files or disabling audit logging.
Amazon GuardDuty supports AWS Organizations declarative policies, enabling centralized threat detection across all accounts and Regions in your AWS organization. The configuration applies to existing accounts and is automatically maintained as new accounts join your organization.
Amazon GuardDuty now offers custom detection rules with 35 prebuilt options for CloudTrail management events, expanding threat detection coverage without log ingestion or storage
Amazon GuardDuty Runtime Monitoring now includes new threat detections for sensitive file modifications on Amazon EC2, EKS, and ECS, helping identify post-compromise attacker activities.
Amazon GuardDuty introduces AI-powered investigations in preview, helping security teams focus on genuine threats
No updates match the selected filters. Try changing them.