AI SIEM — Changelog

26h2 (September 2026)

• NEW Assign threats in bulk: select any set of threats and assign them all to a user (admins) or claim them for yourself (analysts) in one action from the threats toolbar, with an Unassign option too. Before reassigning threats that already have an owner, you're told how many will change hands. Every assignment is recorded individually in the tamper-evident audit trail, and the action is threaded server-side to stay fast at hundreds of threats. Assign-to-me is also offered as a one-click prompt when you move a single unassigned threat to Investigating. Analysts can only assign or unassign their own; viewers cannot assign. All tiers.
• NEW Threats now populate the OpenSearch dashboards: each detected threat is mirrored into the AI SIEM — Threat Overview OpenSearch dashboard, which now also shows total and active threat counts and an active-by-severity breakdown. Threat status changes (resolve, dismiss, etc.) propagate to the dashboard so the active views track triage, and a daily reconcile self-heals the projection after any transient outage. The editor dashboard remains the authoritative live count; the OpenSearch view is time-filtered and reflects threats created after this release. All tiers.
• IMPROVED Operational visibility: the CloudWatch operations dashboard now leads with an alarm-status panel summarizing every AI SIEM alarm at a glance, and a new alarm fires on sustained OpenSearch write failures so a silently-drifting dashboard is caught early. The bulk threat-action buttons also gained explanatory tooltips.
• IMPROVED Playbooks are now generated on demand: an incident-response playbook is created the first time you open a threat and click Generate Playbook (then cached and reused), instead of being pre-generated for every alert-worthy threat. This ties Bedrock usage to the threats you actually work rather than to detection volume — so a burst of many distinct threats no longer runs up model cost or backs up a generation queue — with no change to what you see: the first view generates in seconds, and every view after is instant. Requires playbooks (advanced+).
• NEW Per-detection email alerts: every detection — built-in and custom — now has an Email alerts toggle under Detection Rules. Turn it off to keep a detection scoring threats, building timelines, and showing on the dashboard while silencing its email, so a noisy-but-legitimate pattern no longer forces you to lower its severity or exclude events just to stop the mail. When several rules raise the same threat, the email is muted only if all of them are muted, so a loud rule is never silenced by a quiet co-firing one. Threats raised purely by the ML baseline still alert on score. All tiers (admin).
• IMPROVED Configuration editing is now one working copy with a single Save: edits across Detection Rules, Settings, Data Sources, and the report schedule accumulate together and no longer get lost when you switch panels. A header Save commits everything at once (with the existing conflict check) and Undo discards all unsaved edits and reloads the saved config; an “Unsaved changes” indicator shows whenever the working copy differs from what's saved. Both buttons are inert until there is something to change. All tiers (admin).
• NEW Autosave draft & crash/expiry recovery: in-progress configuration is periodically saved as a private, per-user draft (never applied to the live config). If your session expires or the tab closes mid-edit, the next sign-in offers to restore the draft, showing when it was checkpointed. All tiers (admin).
• NEW Review unsaved changes (in-memory diff): under Settings → Configuration History, the current version's Diff shows a field-level, colour-coded comparison of your unsaved edits against the saved configuration — the same inline diff view used to compare past versions — so you can review exactly what a Save will change. All tiers.
• IMPROVED Clearer duplicate-rule handling: adding a custom rule that duplicates an existing one (by name, or by identical conditions/severity/sources/window) now points you straight at the existing rule — expanding the section, selecting and flashing the row, and describing it by its conditions — instead of a dead-end “already exists” message. All tiers.
• IMPROVED Collapsible Data Sources panel: the Data Sources and AI Monitor Correlation cards now collapse/expand and remember their state per user (server-side, following you across reloads and machines), matching the Settings cards. All tiers.
• IMPROVED Cleaner Audit Activity in threat reports: the report's Audit Activity section now summarizes analyst status changes, remediations, and config changes by actor and action (so a bulk triage no longer floods the report with near-identical rows), shows the most-recent events as a preview with an accurate window total, and points to the shipped Athena saved query “Audit activity (who did what)” for the full row-by-row export. Advanced+.
• NEW Real-time dashboard totals: the Threat Overview donuts now show true whole-table counts by status and severity, kept live as threats are created and triaged — not a sample of the loaded page. A small “live totals” note shows when they were last reconciled and how many threats have been archived all-time. All tiers.
• NEW Server-side threat filtering & pagination: the Threats list filters by status and severity across the whole table (not just the loaded rows) and pages through results with Load more, backed by a new index so filtering is a direct lookup rather than a table scan. Search, type, time and assignee still refine the loaded page. This resolves the old “partial view” cap where filters and counts only reflected a sample. All tiers.
• NEW Automatic threat retention & archive: a daily pass retires old threats from the live list — handled threats after a grace window, anything past a hard age cap, and (as a ceiling) the oldest/lowest-severity when the live count runs high — while keeping the dashboard totals exact and recording every removal in the tamper-evident audit trail. The forensic copy in the datalake and the audit archive keep their own longer retention; only the live operational store is pruned. Tunable under Settings → Threat Retention & Archive (with range checks), monitored with CloudWatch alarms (large batches, active-threat evictions, errors) and its own dashboard row, and safe on very large tables (self-continuing, with a mass-delete circuit breaker). All tiers.
• IMPROVED Faster threat triage: applying a status (single or bulk, e.g. marking a group false-positive) now writes directly and in parallel instead of one round-trip per threat, so triaging a batch is markedly quicker. The active filters in the Threats toolbar are also highlighted so it's clear at a glance which ones are narrowing the list. All tiers.
• NEW AI group tuning: on an expanded group of similar threats, ✨ Analyze asks AI to assess whether they're false positives and propose a rule exclusion to stop the noise, shown with the deterministic facts they share. Two explicit actions follow — apply the exclusion (opens the rule for review, then Save, fully audited) and mark the group false-positive — so triage and tuning happen in one place. Suggestion only and exclusion-only: it can never broaden a rule or open a blind spot, and a human approves every change. Requires custom rules + Bedrock (advanced+).
• NEW Built-in rule exclusions: every built-in detection (root usage, trail/Config tampering, public bucket, wildcard policy, credential stuffing, impossible travel, port scanning) can now carry exclusions — if a condition matches (e.g. deploys from your office CIDR, a known service principal), that rule does not fire. Edit them per rule under Detection Rules, or click “(exclude this)” on a built-in-fired threat to add one pre-filled from the threat, for review then Save. Suppresses only (never hides a real anomaly — the behavioral baseline still scores independently), audited, and available on all tiers. Source-IP exclusions work on flow-log rules too.
• NEW Assess a rule with AI: in the custom-rule builder, ✨ Assess sanity-checks the rule you're editing — does it do what its name says, is it too broad, redundant, or trying to express something the event fields can't (e.g. cross-account comparisons)? The critique is grounded in a field-capability contract (each field's type, valid values, and impossible comparisons) plus deterministic checks, so structural facts don't depend on the model. Advisory only: nothing changes, you decide. Requires custom rules + Bedrock (advanced+).
• IMPROVED Expanded ML behavioral baselines: the per-principal model now spans nine behavioral dimensions, adding region novelty, resource-service novelty, and principal identity type alongside the existing API, time, IP, error, and write signals. All tiers. Baselines re-learn once on upgrade to the new model, then continue online.
• NEW Context-aware severity modifiers (advanced+): a matched rule scores higher when the actor is the root principal or the source IP is outside your configured trusted networks. Modifiers only raise a score, never suppress one, and never key on the ML anomaly signal (no double-counting). The untrusted-IP modifier is inert until you set severityModifiers.trustedIps.
• NEW Threat detail redesigned with Summary and Details tabs: Summary is an at-a-glance triage view (key facts, description, assignment, and a quick overview); Details holds the full evidence, timeline, correlated events, audit history, and playbook. All tiers.
• NEW Analyst notes on threats: add free-text notes as you work an incident. Notes are append-only, shown in the threat's Audit History alongside status changes and remediations, and recorded in the tamper-evident audit trail. All tiers (admin/analyst).
• NEW Threat assignment: admins can assign a threat to any admin/analyst or claim it; analysts can claim it for themselves. The Threats toolbar adds an admin “Assigned to” filter and an “Assigned to me” toggle. Every assignment is audited. All tiers.
• NEW Time-window filter on the Threats list: narrow to the last 24 hours, 48 hours, week, month, 2 months, or older. Composes with the other filters and with bulk actions. All tiers.
• NEW Download incident report: export a self-contained, styled HTML report for a threat (facts, evidence, timeline, correlated identities, full audit trail, and playbook), including live links back to the threat and to any custom rule that fired. All tiers, all roles.
• NEW Jump to the rule that fired: on a threat, the rule that fired it is shown on the Summary tab and in Evidence as a link — a custom rule opens that rule in Detection Rules; a built-in rule (shown with a readable name) opens the built-in rules section — with a “Back to threat” breadcrumb. Any role can follow the link to view; editing still requires admin.
• NEW More custom-rule condition operators: added does-not-contain, does-not-exist, ends-with, the “or-equal” numeric comparisons (≥, ≤), and in-CIDR / not-in-CIDR for IP fields, alongside the existing set. The negated operators make exclusions (e.g. suppressing AWS service-to-service calls) straightforward. Requires custom rules (advanced+).
• IMPROVED Sigma import handles more rules: the importer now translates ends-with, numeric comparisons, CIDR matching, and exists modifiers, and an OR condition (selA or selB, or 1 of …) imports as several rules, one per branch. It remains a bounded translator that never silently mistranslates — regex, |all, and nested/AND-across-selection conditions are listed for you to add by hand (or describe them in plain English for the AI drafter). Requires custom rules (advanced+).
• IMPROVED Configurable retention per tier for threat timelines and the audit trail, plus S3 noncurrent-version expiration for the config bucket, so storage lifecycle matches each tier's retention story. See the retention table in Getting Started.
• NEW Cold log-retention override: the new DatalakeRetentionDays stack parameter lets you keep raw events and threat evidence in the S3 datalake (Athena-queryable) longer than your tier's default — e.g. 2555 for a 7-year policy — without a tier change. OpenSearch hot-search retention stays tier-governed, so cold retention scales independently of hot-index cost.

26h2 (August 2026)

• NEW AI Monitor correlation: metric anomalies are read from the shared OpenSearch domain and merged into threat timelines on the same resource and time window (advanced+). No producer changes; per-subscription opt-in in the editor Data Sources panel.
• NEW Log Processor pattern detections reach AI SIEM through AI Monitor: a per-pattern CloudWatch metric is baselined by AI Monitor, and a spike surfaces as a correlated timeline event.
• NEW On-demand flow query: VPC flow logs are captured to S3 continuously (ALL traffic; cheap), and an anomalous network-egress spike triggers a scoped Athena query over that data for the affected resource and window — full forensic detail at query cost, no VPC changes.
• NEW Flow-log cost guardrail: continuous flow-log processing is duty-cycled (about 10 min/hour) with a circuit breaker that auto-pauses and resets if the backlog falls behind. Data is retained in S3 and the flow queue; CloudTrail/GuardDuty/Config ingestion is unaffected.
• NEW Scheduled Athena scan-sweep backstop keeps port-scan detection alive even when flow processing is throttled or paused.
• NEW Initial release
• NEW CloudTrail ingestion with S3 event-driven processing
• NEW VPC Flow Log ingestion
• NEW GuardDuty + Security Hub finding ingestion via EventBridge
• NEW ML behavioral baselines per IAM principal (RCF)
• NEW Unified threat timeline with cross-signal correlation
• NEW MITRE ATT&CK mapping (advanced+)
• NEW AI-powered incident response playbooks via Bedrock (advanced+)
• NEW Threat intelligence IP enrichment (advanced+)
• NEW Compliance posture scoring (advanced+)
• NEW Auto-remediation: disable keys, revoke sessions, isolate instances (enterprise)
• NEW Editor UI with threat dashboard, timeline viewer, source management
• NEW Deploys on existing Log Processor VPC + OpenSearch (no new cluster)
• NEW 5-tier entitlement system via AWS Marketplace