Amazon GuardDuty Extended Threat Detection now supports Amazon EC2 and Amazon ECS

Amazon GuardDuty Extended Threat Detection Enhancements

AWS has enhanced Amazon GuardDuty Extended Threat Detection to detect multistage attacks targeting Amazon EC2 instances and Amazon ECS clusters running on AWS Fargate or Amazon EC2. This feature uses AI and machine learning to correlate security signals and detect critical threats.

New critical-severity findings include:

• AttackSequence:EC2/CompromisedInstanceGroup
• AttackSequence:ECS/CompromisedCluster

These findings provide attack sequence information, allowing for quicker threat response. GuardDuty analyzes multiple security signals to detect sophisticated attack patterns.

What to do

• Enable Runtime Monitoring for EC2 to improve attack sequence coverage.
• Enable Runtime Monitoring for Fargate or EC2 to detect compromised ECS clusters.
• Start with a 30-day free trial for new GuardDuty customers.

Source: AWS release notes

If you need further guidance on AWS, our experts are available at AWS@westloop.io. You may also reach us by submitting the Contact Us form.