Amazon GuardDuty adds optional threat detection rules

<p>Amazon GuardDuty now offers Custom Detection Rules, a library of 35 prebuilt, opt-in rules for CloudTrail management events that let you extend threat detection coverage to match your environment. Custom Detection Rules produces 26 unique finding types mapped to 10 MITRE ATT&amp;CK® tactics, without the heavy lifting of log ingestion, normalization, or storage.</p> <p>Some threat techniques, such as sharing an AMI externally, disabling flow logs, or signing in without MFA,&nbsp;could be meaningful indicators of compromise in some accounts but routine in others. Custom Detection Rules lets you enable these detections only where the activity is unexpected — expanding your TTP coverage tailored to your environment.</p> <p>To get started, browse Custom Detection Rules via the GuardDuty console or API, and enable rules in dry-run mode to evaluate detection efficacy before going live.</p> <p>Custom Detection Rules is available in all AWS commercial Regions and the AWS GovCloud (US) Regions. To learn more, see <a href="https://docs.aws.amazon.com/guardduty/latest/ug/custom-detection-rules.html">Amazon GuardDuty Custom Detection Rules</a>. To receive programmatic updates on new Amazon GuardDuty features and threat detections, subscribe to the <a href="https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_sns.html">Amazon GuardDuty SNS topic</a>.</p>