AWS GuardDuty Runtime Monitoring: The Security Agent That Sees Inside Your Workloads
Standard GuardDuty analyzes VPC Flow Logs, CloudTrail events, and DNS queries — all metadata about what happened around your workloads. It sees that an EC2 instance connected to a suspicious IP, but it can’t tell you which process made that connection, what command-line arguments it used, or whether it escalated privileges first. Runtime Monitoring changes that. It deploys a lightweight security agent inside your EC2 instances, EKS pods, and ECS tasks that watches operating system events in real time. Process execution, file access, network connections, privilege changes — all visible to GuardDuty without you writing a single detection rule. ...