Amazon GuardDuty expands Extended Threat Detection coverage to Amazon EKS clusters

Amazon GuardDuty has expanded its Extended Threat Detection capabilities to include enhanced security monitoring for Amazon EKS (Elastic Kubernetes Service) clusters.

• Introduces a new critical severity finding type that correlates security signals across EKS audit logs, container runtime behaviors, and AWS API activity
• Helps detect sophisticated multistage attacks targeting containerized applications
• Can identify complex attack patterns like container exploitation and privilege escalation
• Provides detailed findings with timeline, MITRE ATT&CK® mapping, and remediation recommendations
• Requires enabling EKS Protection or Runtime Monitoring (recommended to enable both)

The new feature helps security teams quickly identify and respond to potential Kubernetes cluster compromises by providing comprehensive visibility into attack sequences.