Amazon GuardDuty Introduces Custom Detection Rules for Enhanced Threat Coverage
GuardDuty launched 35 opt-in detection rules for fine-tuned monitoring of CloudTrail management events tailored to diverse environments.
By Lydia Stone· Editorial pseudonym· 2026-09-04 · 1 min read
AI-ASSISTED REPORTING · RETROSPECTIVE ARCHIVE
Retrospective edition: 2026-09-04. Source published: 2026-09-04. Added to this archive: 2026-11-03. This briefing was prepared later from the linked announcement; it was not published on this website on the historical edition date.
Custom Detection Rules expand GuardDuty’s ability to identify suspicious activities mapped to MITRE ATT&CK tactics, such as unauthorized AMI sharing or MFA bypass attempts, which may be contextually normal or malicious depending on the account.
Users can activate rules selectively and run them in dry-run mode before enforcement, minimizing false positives while improving security posture. The rules cover 26 unique finding types and are accessible in all commercial and GovCloud AWS regions.
Source published 2026-09-04. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.