Amazon GuardDuty introduced optional detection rules for Runtime Monitoring. You can turn on more than 50 rules that watch process, file and network activity on EC2 instances, EKS clusters and ECS containers. The update adds four new finding types, including CommandAndControl:Runtime/SuspiciousCommand and CredentialAccess:Runtime/SensitiveFileRead. Rules can be run in dry‑run mode first, then switched to live detection. The feature is available in all commercial AWS Regions and AWS GovCloud (US).
Why it matters
Security teams can tailor GuardDuty to spot environment‑specific threats without affecting existing alerts.
