Guardduty on CuraDevOps

Amazon GuardDuty adds 50+ optional Runtime Monitoring detection rules

Mon, 19 Oct 2026 17:18:05 +0000

Platform/SRE — Plan: GuardDuty Runtime Monitoring now supports 50+ tunable detection rules for EC2, EKS, and ECS workloads, covering MITRE ATT&CK tactics like persistence and privilege escalation. Evaluate and enable relevant rules this quarter, using dry-run mode first to reduce false positives before going live.
CI/CD — Skip
Leader — Learn: AWS expanding GuardDuty’s runtime threat detection with granular, MITRE-mapped rules signals a maturing managed-security posture for AWS-native environments; useful context when assessing build-vs-buy decisions around runtime security tooling.

Fri, 09 Oct 2026 17:15:30 +0000

Platform/SRE — Plan: New GA capability for Aurora PostgreSQL and RDS for PostgreSQL that detects post-credential-compromise data exfiltration and destruction with no agent or config changes required; platform teams running RDS/Aurora should evaluate enabling the add-on for their organization this quarter via the GuardDuty console or CloudFormation.
CI/CD — Skip
Leader — Learn: GuardDuty now extends RDS threat detection beyond login anomalies to query-pattern behavior using ML, relevant for understanding current AWS-native security coverage breadth — no strategic decision or policy change is immediately required.

Fri, 02 Oct 2026 16:25:37 +0000

Platform/SRE — Skip
CI/CD — Skip
Leader — Learn: AWS is consolidating GuardDuty Runtime Monitoring charges under Security Hub rather than billing them separately; no cost change is implied, but budget owners should verify Cost Explorer dashboards and alerts still reflect accurate Security Hub spend after the line-item restructuring.