JA EN
shiichan

GuardDuty Adds 35 Detection Rules You Can Turn On for Your Own Environment!

AWS What's New ★★★★ View Markdown
#aws#security

Hi, it's me, Shiichan! Today I've got news that GuardDuty users handling security will want to hear.

AWS What's New aws.amazon.com

What was announced?

AWS What's New announced that Amazon GuardDuty now supports "Custom Detection Rules" — a library of 35 prebuilt, opt-in rules for CloudTrail management events. Together they produce 26 unique finding types mapped to 10 MITRE ATT&CK® tactics.

Why it matters

Actions like sharing an AMI externally, disabling flow logs, or signing in without MFA can be a real sign of compromise in one account, and completely routine in another. Until now, GuardDuty didn't ship standard detections for these context-dependent behaviors. Custom Detection Rules exists so you can pick and enable exactly the ones that make sense for your own account's reality.

What changes

You no longer have to build log ingestion, normalization, and storage yourself — just browse and enable rules from the GuardDuty console or API to extend your detection coverage. Because you can turn on only the behaviors that are genuinely unexpected in your environment, you can expand your TTP (tactics, techniques, and procedures) coverage without adding noise.

Dive Deep

To get started, browse Custom Detection Rules in the GuardDuty console or via the API, and enable them in dry-run mode first. That lets you see how often each rule would fire and whether it fits your environment before you flip it into active alerting or blocking. Custom Detection Rules is available in all AWS commercial Regions and the AWS GovCloud (US) Regions.

Wrap-up

  • GuardDuty now offers 35 opt-in detection rules for CloudTrail management events
  • The 26 resulting finding types map to 10 MITRE ATT&CK tactics
  • You can selectively detect context-dependent actions like external AMI sharing, disabled flow logs, or MFA-less sign-ins
  • Start in dry-run mode to validate effectiveness before going live
  • A great fit for security teams who want to tune detection rules to their own account's reality

Related posts