Amazon GuardDuty adds optional threat detection rules

Amazon GuardDuty now offers Custom Detection Rules, a library of 35 prebuilt opt-in rules for CloudTrail management events that extend threat detection coverage to match your environment.

• 35 prebuilt rules for CloudTrail management events with no log ingestion or storage overhead
• Produces 26 unique finding types mapped to 10 MITRE ATT&CK tactics
• Enable detections selectively for environment-specific threats like external AMI sharing or disabled flow logs
• Dry-run mode available to evaluate detection efficacy before enabling
• Available in all AWS commercial Regions and AWS GovCloud (US)

Custom Detection Rules enables organizations to tailor threat detection to their specific environments without managing log infrastructure.