Amazon GuardDuty now monitors runtime activity from containers running on Amazon EKS

Amazon GuardDuty is expanding threat detection coverage by continuously monitoring container runtime activity on Amazon EKS to identify malicious or suspicious behavior.

The new fully-managed security agent monitors on-host operating system-level behavior, file access, process execution and network connections to detect potential threats.

GuardDuty generates security findings that pinpoint specific containers by providing details on Pod ID, Image ID, EKS cluster tag, executable path and process lineage.

The service includes two dozen new detections that combine GuardDuty and EKS audit log monitoring, providing tailored identification of potential threats for Amazon EKS deployments.