🧰 GuardDuty

The items that name it 3

• [tl;dr sec] #352 - Unprompted Slides, AWS AI Post-compromise Trends, Malicious LLM API Routers
  article2026-10-29

  AWS threat detection service that some models proposed tampering with in the AWS post-compromise tests.

• [tl;dr sec] #346 - Can AI Do Novel Security Research?, Anthropic's Threat Intel Report, How Cloudflare Enforces Engineering Standards
  article2026-09-17

  Provides findings with Kubernetes context (namespace, pod, ServiceAccount) and AWS identity correlation for EKS investigations

• AWS EKS forensics: data sources and investigation tooling (Synacktiv)
  articleIt is written here as GuardDuty (EKS Protection, Runtime Monitoring).

  Managed threat detection service; EKS Protection consumes EKS audit logs and adds Kubernetes context to findings; Runtime Monitoring provides eBPF-based in-container syscall visibility (optional, not supported on Fargate)