What Happened
On October 19, 2026, Amazon GuardDuty introduced more than 50 optional Runtime Monitoring rules for process, file, and network activity on EC2, EKS, and ECS workloads running on EC2 or AWS Fargate. The rules span 13 finding types mapped to MITRE ATT&CK tactics. Four finding types are new, covering suspicious commands and sensitive-file reads associated with command and control, credential access, discovery, and exfiltration. Teams can evaluate rules in dry-run mode before enabling live detection. The rules are available in all AWS commercial and GovCloud (US) Regions. [1]
Why It Matters to Businesses
This gives security teams more control over which runtime behaviors GuardDuty flags, without requiring every optional rule to become an active alert at once. Dry-run evaluation is particularly useful for workloads where administrative commands or file access may look suspicious but be legitimate. [1]
Kimbodo Engineering Perspective
The practical decision is not whether to enable all 50-plus rules. It is which detections produce actionable findings for each workload. A rule appropriate for an application container may generate noise on an administrative host. We would assess results by workload owner, finding type, and response path before promoting a rule from dry run to live detection.
How We Would Implement It
- Inventory GuardDuty Runtime Monitoring coverage across EC2, EKS, and ECS, including the Regions and accounts in scope.
- Evaluate optional rules in dry-run mode against representative production workloads; review results with security and application owners. [1]
- Enable selected rules in stages, route live findings into the existing incident workflow, and document who investigates each finding type.
- Revisit rule selections after workload changes or repeated false positives.
Risks, Costs and Security
More detections can mean more triage work. Dry-run results should be checked for legitimate commands and file reads before live rollout, but a quiet dry run is not proof that a rule will never produce noise or miss an attack. Validate GuardDuty pricing and operational impact for the accounts and workloads being monitored, and restrict access to finding data and rule configuration.
Where Kimbodo Comes In
Kimbodo builds and operates this in production for businesses — see our AI Application Development practice, or Estimate My AI Application.
