# Amazon GuardDuty adds optional runtime detection rules

> GuardDuty now offers over 50 optional rules for Runtime Monitoring on EC2, EKS and ECS, with four new finding types.

Oossa · 2026-10-19 · https://oossa.com/en/amazon-guardduty-adds-optional-runtime-detection-rules

Amazon GuardDuty introduced optional detection rules for Runtime Monitoring. You can turn on more than 50 rules that watch process, file and network activity on EC2 instances, EKS clusters and ECS containers. The update adds four new finding types, including CommandAndControl:Runtime/SuspiciousCommand and CredentialAccess:Runtime/SensitiveFileRead. Rules can be run in dry‑run mode first, then switched to live detection. The feature is available in all commercial AWS Regions and AWS GovCloud (US).

## The facts

- More than 50 runtime monitoring rules are now optional.
- Four new finding types were added, e.g., CommandAndControl:Runtime/SuspiciousCommand.

## Why it matters

Security teams can tailor GuardDuty to spot environment‑specific threats without affecting existing alerts.

## Sources & references

1. [Amazon GuardDuty adds optional threat detection rules for Runtime Monitoring](https://aws.amazon.com/about-aws/whats-new/2026/10/guardduty-runtime-optional-detection-rules/) – AWS, 2026-10-19

Last updated: 2026-10-19