GET TO KNOW AMAZON GUARDDUTY RUNTIME MONITORING FOR AMAZON EC2

Summary from the TLDR InfoSec newsletter

Amazon has expanded GuardDuty's capabilities by adding a security agent that can collect runtime metrics for EC2 instances. GuardDuty uses the agent to monitor system commands and arguments and uses event correlation to surface findings in 5 new finding types. AWS recommends using these findings in an event-driven architecture to be able to rapidly respond to findings and potential compromise. This blog post walks through sample scenarios and details deployment strategies.