AI SIEM — Changelog

26h2 (September 2026)

• NEW Real-time dashboard totals: the Threat Overview donuts now show true whole-table counts by status and severity, kept live as threats are created and triaged — not a sample of the loaded page. A small “live totals” note shows when they were last reconciled and how many threats have been archived all-time. All tiers.
• NEW Server-side threat filtering & pagination: the Threats list filters by status and severity across the whole table (not just the loaded rows) and pages through results with Load more, backed by a new index so filtering is a direct lookup rather than a table scan. Search, type, time and assignee still refine the loaded page. This resolves the old “partial view” cap where filters and counts only reflected a sample. All tiers.
• NEW Automatic threat retention & archive: a daily pass retires old threats from the live list — handled threats after a grace window, anything past a hard age cap, and (as a ceiling) the oldest/lowest-severity when the live count runs high — while keeping the dashboard totals exact and recording every removal in the tamper-evident audit trail. The forensic copy in the datalake and the audit archive keep their own longer retention; only the live operational store is pruned. Tunable under Settings → Threat Retention & Archive (with range checks), monitored with CloudWatch alarms (large batches, active-threat evictions, errors) and its own dashboard row, and safe on very large tables (self-continuing, with a mass-delete circuit breaker). All tiers.
• IMPROVED Faster threat triage: applying a status (single or bulk, e.g. marking a group false-positive) now writes directly and in parallel instead of one round-trip per threat, so triaging a batch is markedly quicker. The active filters in the Threats toolbar are also highlighted so it's clear at a glance which ones are narrowing the list. All tiers.
• NEW AI group tuning: on an expanded group of similar threats, ✨ Analyze asks AI to assess whether they're false positives and propose a rule exclusion to stop the noise, shown with the deterministic facts they share. Two explicit actions follow — apply the exclusion (opens the rule for review, then Save, fully audited) and mark the group false-positive — so triage and tuning happen in one place. Suggestion only and exclusion-only: it can never broaden a rule or open a blind spot, and a human approves every change. Requires custom rules + Bedrock (advanced+).
• NEW Built-in rule exclusions: every built-in detection (root usage, trail/Config tampering, public bucket, wildcard policy, credential stuffing, impossible travel, port scanning) can now carry exclusions — if a condition matches (e.g. deploys from your office CIDR, a known service principal), that rule does not fire. Edit them per rule under Detection Rules, or click “(exclude this)” on a built-in-fired threat to add one pre-filled from the threat, for review then Save. Suppresses only (never hides a real anomaly — the behavioral baseline still scores independently), audited, and available on all tiers. Source-IP exclusions work on flow-log rules too.
• NEW Assess a rule with AI: in the custom-rule builder, ✨ Assess sanity-checks the rule you're editing — does it do what its name says, is it too broad, redundant, or trying to express something the event fields can't (e.g. cross-account comparisons)? The critique is grounded in a field-capability contract (each field's type, valid values, and impossible comparisons) plus deterministic checks, so structural facts don't depend on the model. Advisory only: nothing changes, you decide. Requires custom rules + Bedrock (advanced+).
• IMPROVED Expanded ML behavioral baselines: the per-principal model now spans nine behavioral dimensions, adding region novelty, resource-service novelty, and principal identity type alongside the existing API, time, IP, error, and write signals. All tiers. Baselines re-learn once on upgrade to the new model, then continue online.
• NEW Context-aware severity modifiers (advanced+): a matched rule scores higher when the actor is the root principal or the source IP is outside your configured trusted networks. Modifiers only raise a score, never suppress one, and never key on the ML anomaly signal (no double-counting). The untrusted-IP modifier is inert until you set severityModifiers.trustedIps.
• NEW Threat detail redesigned with Summary and Details tabs: Summary is an at-a-glance triage view (key facts, description, assignment, and a quick overview); Details holds the full evidence, timeline, correlated events, audit history, and playbook. All tiers.
• NEW Analyst notes on threats: add free-text notes as you work an incident. Notes are append-only, shown in the threat's Audit History alongside status changes and remediations, and recorded in the tamper-evident audit trail. All tiers (admin/analyst).
• NEW Threat assignment: admins can assign a threat to any admin/analyst or claim it; analysts can claim it for themselves. The Threats toolbar adds an admin “Assigned to” filter and an “Assigned to me” toggle. Every assignment is audited. All tiers.
• NEW Time-window filter on the Threats list: narrow to the last 24 hours, 48 hours, week, month, 2 months, or older. Composes with the other filters and with bulk actions. All tiers.
• NEW Download incident report: export a self-contained, styled HTML report for a threat (facts, evidence, timeline, correlated identities, full audit trail, and playbook), including live links back to the threat and to any custom rule that fired. All tiers, all roles.
• NEW Jump to the rule that fired: on a threat, the rule that fired it is shown on the Summary tab and in Evidence as a link — a custom rule opens that rule in Detection Rules; a built-in rule (shown with a readable name) opens the built-in rules section — with a “Back to threat” breadcrumb. Any role can follow the link to view; editing still requires admin.
• NEW More custom-rule condition operators: added does-not-contain, does-not-exist, ends-with, the “or-equal” numeric comparisons (≥, ≤), and in-CIDR / not-in-CIDR for IP fields, alongside the existing set. The negated operators make exclusions (e.g. suppressing AWS service-to-service calls) straightforward. Requires custom rules (advanced+).
• IMPROVED Sigma import handles more rules: the importer now translates ends-with, numeric comparisons, CIDR matching, and exists modifiers, and an OR condition (selA or selB, or 1 of …) imports as several rules, one per branch. It remains a bounded translator that never silently mistranslates — regex, |all, and nested/AND-across-selection conditions are listed for you to add by hand (or describe them in plain English for the AI drafter). Requires custom rules (advanced+).
• IMPROVED Configurable retention per tier for threat timelines and the audit trail, plus S3 noncurrent-version expiration for the config bucket, so storage lifecycle matches each tier's retention story. See the retention table in Getting Started.
• NEW Cold log-retention override: the new DatalakeRetentionDays stack parameter lets you keep raw events and threat evidence in the S3 datalake (Athena-queryable) longer than your tier's default — e.g. 2555 for a 7-year policy — without a tier change. OpenSearch hot-search retention stays tier-governed, so cold retention scales independently of hot-index cost.

26h2 (August 2026)

• NEW AI Monitor correlation: metric anomalies are read from the shared OpenSearch domain and merged into threat timelines on the same resource and time window (advanced+). No producer changes; per-subscription opt-in in the editor Data Sources panel.
• NEW Log Processor pattern detections reach AI SIEM through AI Monitor: a per-pattern CloudWatch metric is baselined by AI Monitor, and a spike surfaces as a correlated timeline event.
• NEW On-demand flow query: VPC flow logs are captured to S3 continuously (ALL traffic; cheap), and an anomalous network-egress spike triggers a scoped Athena query over that data for the affected resource and window — full forensic detail at query cost, no VPC changes.
• NEW Flow-log cost guardrail: continuous flow-log processing is duty-cycled (about 10 min/hour) with a circuit breaker that auto-pauses and resets if the backlog falls behind. Data is retained in S3 and the flow queue; CloudTrail/GuardDuty/Config ingestion is unaffected.
• NEW Scheduled Athena scan-sweep backstop keeps port-scan detection alive even when flow processing is throttled or paused.
• NEW Initial release
• NEW CloudTrail ingestion with S3 event-driven processing
• NEW VPC Flow Log ingestion
• NEW GuardDuty + Security Hub finding ingestion via EventBridge
• NEW ML behavioral baselines per IAM principal (RCF)
• NEW Unified threat timeline with cross-signal correlation
• NEW MITRE ATT&CK mapping (advanced+)
• NEW AI-powered incident response playbooks via Bedrock (advanced+)
• NEW Threat intelligence IP enrichment (advanced+)
• NEW Compliance posture scoring (advanced+)
• NEW Auto-remediation: disable keys, revoke sessions, isolate instances (enterprise)
• NEW Editor UI with threat dashboard, timeline viewer, source management
• NEW Deploys on existing Log Processor VPC + OpenSearch (no new cluster)
• NEW 5-tier entitlement system via AWS Marketplace