AI SIEM — Changelog

AI SIEM is under active development, and these entries are intentionally detailed. While the product is evolving quickly, we document each change at a granular level — what changed, why, and how it behaves — so you can see exactly what a release alters and make informed upgrade decisions. As the product matures, entries will become higher level; for now the depth is deliberate.

26h4 (October 2026)

In development — October 2–6, 2026 (updated as changes land)

• NEW AI Monitor anomalies become threats: any AI Monitor metric subscription you opt into for correlation can now raise a standalone AI SIEM threat when it flags an anomaly — not only enrich an existing timeline. This is generic over any namespace, metric, and dimensions: a Log Processor regex-pattern spike (an SSN or SQL-injection pattern in your application logs), or any AWS-service metric (an EC2/RDS/Lambda signal) AI Monitor watches. AI Monitor owns the “is this anomalous?” decision via each subscription's own threshold; AI SIEM promotes the ones you selected into the threat queue, with a timeline and an on-demand playbook like any other detection. The threat records only the metric identity, dimensions, value, and anomaly score — never the matched content. Requires the correlation feature + AI Monitor (advanced+).
• FIXED AI Monitor correlation now matches reliably: metric-anomaly correlation is matched by the subscription's specification (namespace, metric, and dimensions resolved from AI Monitor's catalog) rather than an identifier the anomaly documents do not carry, so opted-in subscriptions correlate as intended. Requires correlation + AI Monitor (advanced+).
• IMPROVED Human-readable timestamps in alert emails: threat alert emails now render the detection time as a readable UTC timestamp (e.g. Oct 3, 2026, 4:45 AM UTC) and, when a display timezone is configured in Settings, append the same moment in that local zone — so an on-call responder reads the time at a glance instead of parsing a raw ISO string. UTC remains the canonical value; the local time is additive and falls back cleanly to UTC-only when no timezone is set. All tiers.
• IMPROVED Flow-log analysis is Athena-first for flat, predictable cost: VPC flow-log detection runs entirely as scheduled, partition-pruned Athena queries — a 15-minute port-scan sweep and an hourly large-egress/exfiltration sweep — rather than scoring every flow record on a Lambda. Cost scales with query count, not traffic volume, and stays flat across many accounts and VPCs. Flow logs are always retained in S3 and remain fully queryable for forensics; detection can be turned off per deployment without affecting any other source. Enterprise/flow tiers.
• NEW Threat lifecycle at a glance: a threat's Summary tab now shows a compact lifecycle trail — the actual chronological path of status transitions (acknowledged, investigating, dismissed, resolved, …) with remediation milestones interleaved, and the current state called out. It reflects what really happened, including non-linear cycles (dismiss then restore), rather than an idealized forward stepper, and never implies a stage that did not occur. Long or heavily-cycled histories collapse the oldest transitions into a hover-to-see “+N earlier” marker; the full record always remains in Audit History. Derived from the existing audit trail (no new data). All tiers.
• NEW Jump from an AI Monitor threat to its source: a threat promoted from an AI Monitor metric anomaly now links its Source straight to Configure → Data Sources → AI Monitor Correlation, so you can review or change which subscriptions correlate without hunting for the panel. Requires correlation + AI Monitor (advanced+).
• IMPROVED Select all / none on the filtered threat list: the Threats toolbar’s selection control is now an explicit Select all | none pair (with a tri-state checkbox), operating on the threats matching the current filters — so filtering by type (or any filter) and selecting them all for a bulk action is one click. All tiers.
• IMPROVED Clearer Data Sources guidance: the CloudTrail bucket field now explains it takes your existing trail bucket (unlike the stack-managed VPC Flow Logs bucket), that AI SIEM ingests objects on arrival with no partition layout required and never queries the bucket directly, and the cross-account grants a remote bucket needs. AWS Config now notes it can be high-volume and overlaps CloudTrail, with configuration/compliance drift as its distinct value. All tiers.
• FIXED AI group tuning (Analyze) and rule assessment no longer error: the privacy-mode guard the AI assist paths (group Analyze, rule Assess, rule refine) depend on was not initialized, which could raise an error when invoked. Identifier redaction before Bedrock is always on, as intended, and these actions now run cleanly. Requires custom rules + Bedrock (advanced+).
• FIXED Operational oversight documented: Getting Started now describes AI SIEM’s monitor-the-monitor discipline — the CloudWatch alarms that give independent oversight of the SIEM itself (a critical-threat signal plus pipeline-health alarms for queues, errors, OpenSearch writes, the audit store, and the archive). All tiers.
• IMPROVED Security response headers on the editor: the editor now sends a baseline set of browser security headers on the console page and every API response — a Content-Security-Policy that confines scripts, styles, and framing to the application’s own origin (plus AWS S3 for signed report previews), HTTP Strict-Transport-Security, X-Content-Type-Options: nosniff, clickjacking protection (X-Frame-Options / frame-ancestors), a referrer policy, and a permissions policy disabling geolocation/microphone/camera. This hardens the only internet-facing surface against cross-site scripting and clickjacking, and resolves the header-hardening items from the web-application security scan. All tiers.
• FIXED Report preview restored under the new security policy: the Content-Security-Policy’s framing rule now permits the signed-URL report preview to load, so viewing a generated report in the Reports panel renders inline as before — without relaxing framing for any non-AWS origin. All tiers with reports (advanced+).
• NEW AI Monitor Correlation in Data Source Health: the dashboard’s Data Source Health card now includes an AI Monitor Correlation row, so correlation shows up alongside CloudTrail, GuardDuty, and the rest instead of only on the Data Sources panel. Its state reflects how correlation is wired — not configured (AI Monitor stack not set), no subscriptions correlated yet, or healthy with a count of the subscriptions you’ve opted in — so a glance tells you whether anomaly correlation is actually active. Requires correlation + AI Monitor (advanced+).
• IMPROVED Progress indicator for bulk threat actions: bulk status changes and bulk assign/unassign now show a persistent in-progress indicator on the threats toolbar and disable the controls for the duration of the operation — so a large bulk action looks like it’s working rather than unresponsive, and can’t be fired twice by accident. All tiers.
• IMPROVED Hardened AI Monitor correlation matching: the dimension matching that decides whether an AI Monitor anomaly correlates (and promotes to a threat) is now guarded against pathological subscription patterns — an abnormally long or malformed dimension pattern degrades safely to an exact comparison rather than risking a slow match, and the two services that perform this matching are pinned to behave identically. Internal hardening; no change to normal correlation behavior. Requires correlation + AI Monitor (advanced+).
• IMPROVED Tidier threat Summary triage block: the status, assignment, origin (“fired by”), overview, and lifecycle lines on a threat’s Summary tab are now grouped into a single nested panel — matching the key-facts panel above it — so the tab reads as two clear blocks instead of a stack of loose lines. All tiers.
• IMPROVED Clearer VPC Flow trend charts: the VPC Flow panel’s Trends card now shows three compact charts instead of one oversized, stretched graph — threats found, sweep activity (so a healthy, flat-cost deployment visibly shows sweeps running even with zero threats), and a threats-by-sweep-type breakdown (port scan vs large egress) over the last 24h. The sparklines no longer distort to fill the card, and when flow detection is off the card says so plainly rather than drawing empty axes. Enterprise/flow tiers.
• FIXED Lambda runtime logging no longer raises false threats: every Lambda function writes CloudWatch Logs on each invocation (CreateLogStream, PutLogEvents), and CloudTrail records these as normal AssumedRole calls from the execution role with a public source IP (NAT or VPC-endpoint routing). The detection engine now recognises the Lambda runtime’s awslambda-worker user agent as infrastructure plumbing — the same service-call gate that already skips CloudFormation, Auto Scaling, and other AWS-internal traffic — so these routine events no longer score on ML or rules and no longer produce noise threats. Existing false threats are unaffected (dismiss or clear them); no new ones are created. All tiers.
• FIXED Dismissed threats no longer counted as open findings: the compliance posture view counted a dismissed threat’s type as an open finding, while correctly excluding resolved and false-positive ones. All three handled states (resolved, false positive, dismissed) are now treated consistently, so dismissing a threat removes its type from the open-findings tally as expected. All tiers.

26h3 (September 2026)

Development milestone — September 29, 2026

• NEW Delegated remediation via AWS Systems Manager Automation: response actions now run as SSM Automation runbooks that you own, under an AutomationAssumeRole you create and scope — the AWS-managed prebuilts (disable a key, isolate an instance, block public access), the samples we ship, or your own. AI SIEM itself holds no standing IAM or EC2 write power: it only calls StartAutomationExecution and reads status, so a runbook can never do more than the role you granted. Map any threat type to a runbook and its parameters entirely in config — adding a remediation is a config change, never a code or template change. A one-command add-on (deploy-remediation) creates the role and publishes its ARN to SSM, so the editor auto-fills it in the mapping picker; sample runbooks ship in the helper-scripts bundle (remediation_docs/). Cross-account is native via SSM multi-account targets. This replaces the earlier self-privileged auto-remediation. Enterprise tier.
• NEW Staged approval, scheduling, and a remediation watchdog: every action can be staged for one-click admin approval or auto-approved per runbook; deferred to a named window you define (weekly, monthly, a specific date, or ad-hoc) so disruptive fixes land off-peak; and auto-resolve the threat on success. A remediation badge (pending, scheduled, remediating, remediated, failed, stalled) tracks each action independently of triage status, and you can filter the threat queue by remediation state (backed by a new index, so it's a direct lookup). A scheduler tick starts due items once, skips anything already handled, and a watchdog flags remediations that run past a configurable limit (stalled) or that were never picked up in time (late-start), with transient SSM throttling retried automatically. Enterprise tier.
• NEW VPC Flow panel: a dedicated view to choose the flow analysis mode (Athena or off), tune detection thresholds (including per-VPC overrides), and see live flow health — an estimated scan-cost indicator, flow-query Lambda activity, sweep runs and threats found, and an on-demand “top talkers” query to spot the noisiest sources. A CloudWatch dashboard section mirrors it for always-on monitoring. Turns flow cost from a surprise into something you can see and control. Enterprise/flow tiers.
• NEW Threat audit history from the archive: from an investigation result — or a threat that has aged out of the live store — you can now pull that threat’s full action history (status changes, notes, remediations) directly from the tamper-evident WORM audit archive, so “what was done about this?” is answerable even after the live record is gone. Advanced+.
• IMPROVED Safer configuration editing with multiple admins: the editor now shows a non-blocking indicator of other administrators currently working, warns before remediating when you have unsaved configuration changes, and rejects a remediation whose underlying configuration changed out from under you (reload-and-review) — so concurrent editors don’t silently clobber each other or act on stale settings. All tiers (admin).
• NEW Investigations — point-and-click threat search over any date range: a new Investigations view answers the post-mortem question “what was detected between these two dates?” without writing a line of SQL. Pick a From and To date and AI SIEM queries the long-retention forensic archive — so it reaches further back than the live queue — and lists every threat in the window, newest first. Each result opens the full threat for its current status, timeline, and playbook (or, for a threat that has aged out of the live store, its detection-time record from the archive). Queries run in the background: a fast one returns in seconds inline, a wide one keeps working and appears under Previous investigations to reopen later, so nothing hangs the screen. Results are saved and retrievable, and expire on the same retention window as reports. Admin or analyst; advanced+.
• IMPROVED Report & investigation retention: generated reports and saved investigations now expire automatically on a per-tier retention window (matching the audit-trail retention for that tier) instead of accumulating indefinitely, so forensic artifacts are kept as long as they are useful and then cleaned up. All tiers with reports (advanced+).
• IMPROVED Safer remediation with multiple admins: remediation now guards against acting on stale configuration. If you have unsaved edits, clicking Remediate reminds you it runs against the last-saved config so an in-progress mapping or schedule change isn’t silently skipped; and if another admin changed the remediation configuration since you loaded the page, the request is safely rejected with a prompt to reload and review rather than running under a policy you never saw. A lightweight, non-blocking presence indicator in the header also shows when other administrators are in the editor, so a small team can coordinate and avoid overlapping edits — advisory only, nobody is ever locked out. All tiers (admin).
• NEW “SLA breached” view for slow or overdue remediations: when a remediation runs past its stall limit or a scheduled one is never picked up in time, that breach is now recorded as a durable flag on the threat — and it persists after the run finishes, so a remediation that eventually succeeded (or later failed) but took too long stays findable instead of disappearing behind its final badge. A new SLA breached filter in the Threats toolbar lists every one of them in a single click (each labelled ran long or never started), the dashboard Remediations panel shows a running SLA breached count that jumps straight to that list, and the threat report’s Remediation Summary now flags, per outcome, how many breached — so a busy operator can triage the slow ones later without hunting through the audit trail. Backed by its own index so the list is a direct lookup no matter how much remediation history accrues. Enterprise tier.
• IMPROVED Remediation Summary counts each remediation once: the threat report’s remediation section now tallies each remediation by its final outcome (succeeded / failed / stalled / still in flight) rather than counting every lifecycle event, so the totals add up cleanly and the per-action breakdown reflects real results instead of overlapping stages. Enterprise tier.
• IMPROVED Configuration integrity monitoring reliability: fixed a cold-start case where the configuration seal was not written, which could raise a spurious “configuration changed outside the editor” alert; the seal is now written consistently and the threat view projects remediation state. All tiers.
• NEW Bedrock privacy mode — identifiers redacted before AI, encrypted at rest: when a playbook is generated, real AWS identifiers (ARNs, account IDs, IAM principals, and public/internal IP addresses) are replaced with type-preserving placeholders before anything is sent to Bedrock, so the model reasons over the shape of your environment without ever seeing a literal identifier. The mapping back to the real values is encrypted with a dedicated KMS key and stored encrypted at rest; the editor decrypts and restores the real values only when you view the playbook. You keep a fully specific, actionable playbook while the underlying identifiers are minimized end to end. Requires playbooks (advanced+).
• NEW Playbook privacy provenance badge: each generated playbook now shows how it was protected — redacted before AI & encrypted at rest, or a plain-template fallback — so you can see at a glance whether a given playbook went through the privacy path. Advanced+.
• IMPROVED Playbook safety guard: before a generated playbook is stored, it is verified to contain no un-redacted real identifier; if anything slipped through, the model output is discarded and a safe deterministic template is used instead, with an operational alarm raised for the operator. This never exposes an unprotected identifier at rest. Advanced+.
• IMPROVED Threat ID shown in the detail view: the selected threat's ID is now displayed (and selectable) in the Summary and Details tabs, making it easy to reference a specific threat in reports or support requests. All tiers.
• NEW Investigations filters & export: a range investigation can now be narrowed server-side by principal, source IP, threat type, MITRE tactic/technique, and minimum severity — so you can ask “everything this principal did in these two weeks” or “all Credential Access over the quarter” in one query. Results export to CSV or JSON for an incident ticket or compliance evidence, and reopening a saved run repopulates the form (dates + filters) so you can tweak and re-run without retyping. Admin or analyst; advanced+.
• IMPROVED Faster range investigations: the forensic threat archive is now partitioned by day, so an investigation scans only the days in your window instead of whole months — large date-range queries return substantially faster. Advanced+.
• IMPROVED Clearer Reports & Investigations views: opening a report preview or an investigation result now replaces the list with the detail and a Close control at the top, instead of stacking the detail under a long list — so the two surfaces read and navigate the same way. All tiers with reports (advanced+).
• IMPROVED Bedrock privacy is always on, every tier, and verified at read time: identifier redaction before the AI is no longer an optional mode — it is always applied and cannot be turned off. The deterministic fallback playbook is now also redacted and encrypted at rest, so no playbook of any path stores a real identifier in the clear, and the privacy badge is a verified claim (re-checked against the stored playbook on open) rather than a stored marker — if a known identifier is ever found despite a redacted claim, the badge warns instead of showing a false all-clear. If you hit a redaction gap, a one-click shapes-only privacy report (identifier types only, never values) can be sent to support to fix it. All tiers.
• IMPROVED VPC Flow panel is honest about the active mode: the panel and dashboard card now show the cost driver of the mode you are actually running — they report the real bytes scanned by the sweeps — so a healthy, flat-cost deployment no longer looks idle. VPC Flow Logs are also presented as a managed source (the stack owns the bucket) rather than asking for a bucket that cannot be changed. Essential+.
• NEW Per-VPC detection thresholds: flow-log detection can now be tuned per VPC instead of one setting for the whole fleet. Give a VPC a name and its own port-scan and large-egress thresholds — tighten a sensitive production VPC, relax a noisy sandbox — and the scheduled Athena sweeps apply each VPC’s own thresholds, scoped to that VPC. VPCs you don’t name keep using the global defaults. The VPC picker is populated from the VPCs actually sending flow logs, so there’s no hunting for IDs. Essential+.
• NEW “Scan unpinned VPCs” control: a single checkbox decides what happens to VPCs with no per-VPC profile — scan them with the global thresholds (default), or ignore them entirely so detection runs only on the VPCs you explicitly list (an allowlist). Essential+.
• IMPROVED Threats name their VPC: flow-based threats (port scans, large egress) now record and display the VPC the activity came from, in the threat detail and forensic queries, so you can tell at a glance which network a detection belongs to. Essential+.
• IMPROVED Threat reports break down flow threats by VPC: scheduled and on-demand reports now include a Threats by VPC rollup for flow-sourced detections, so a report shows which networks are generating port-scan and exfiltration activity. Threats with no VPC attribution are grouped as unattributed. Essential+.

26h2 (September 2026)

Development milestone — September 17, 2026

• NEW Assign threats in bulk: select any set of threats and assign them all to a user (admins) or claim them for yourself (analysts) in one action from the threats toolbar, with an Unassign option too. Before reassigning threats that already have an owner, you're told how many will change hands. Every assignment is recorded individually in the tamper-evident audit trail, and the action is threaded server-side to stay fast at hundreds of threats. Assign-to-me is also offered as a one-click prompt when you move a single unassigned threat to Investigating. Analysts can only assign or unassign their own; viewers cannot assign. All tiers.
• NEW Threats now populate the OpenSearch dashboards: each detected threat is mirrored into the AI SIEM — Threat Overview OpenSearch dashboard, which now also shows total and active threat counts and an active-by-severity breakdown. Threat status changes (resolve, dismiss, etc.) propagate to the dashboard so the active views track triage, and a daily reconcile self-heals the projection after any transient outage. The editor dashboard remains the authoritative live count; the OpenSearch view is time-filtered and reflects threats created after this release. All tiers.
• IMPROVED Operational visibility: the CloudWatch operations dashboard now leads with an alarm-status panel summarizing every AI SIEM alarm at a glance, and a new alarm fires on sustained OpenSearch write failures so a silently-drifting dashboard is caught early. The bulk threat-action buttons also gained explanatory tooltips.
• IMPROVED Playbooks are now generated on demand: an incident-response playbook is created the first time you open a threat and click Generate Playbook (then cached and reused), instead of being pre-generated for every alert-worthy threat. This ties Bedrock usage to the threats you actually work rather than to detection volume — so a burst of many distinct threats no longer runs up model cost or backs up a generation queue — with no change to what you see: the first view generates in seconds, and every view after is instant. Requires playbooks (advanced+).
• NEW Per-detection email alerts: every detection — built-in and custom — now has an Email alerts toggle under Detection Rules. Turn it off to keep a detection scoring threats, building timelines, and showing on the dashboard while silencing its email, so a noisy-but-legitimate pattern no longer forces you to lower its severity or exclude events just to stop the mail. When several rules raise the same threat, the email is muted only if all of them are muted, so a loud rule is never silenced by a quiet co-firing one. Threats raised purely by the ML baseline still alert on score. All tiers (admin).
• IMPROVED Configuration editing is now one working copy with a single Save: edits across Detection Rules, Settings, Data Sources, and the report schedule accumulate together and no longer get lost when you switch panels. A header Save commits everything at once (with the existing conflict check) and Undo discards all unsaved edits and reloads the saved config; an “Unsaved changes” indicator shows whenever the working copy differs from what's saved. Both buttons are inert until there is something to change. All tiers (admin).
• NEW Autosave draft & crash/expiry recovery: in-progress configuration is periodically saved as a private, per-user draft (never applied to the live config). If your session expires or the tab closes mid-edit, the next sign-in offers to restore the draft, showing when it was checkpointed. All tiers (admin).
• NEW Review unsaved changes (in-memory diff): under Settings → Configuration History, the current version's Diff shows a field-level, colour-coded comparison of your unsaved edits against the saved configuration — the same inline diff view used to compare past versions — so you can review exactly what a Save will change. All tiers.
• IMPROVED Clearer duplicate-rule handling: adding a custom rule that duplicates an existing one (by name, or by identical conditions/severity/sources/window) now points you straight at the existing rule — expanding the section, selecting and flashing the row, and describing it by its conditions — instead of a dead-end “already exists” message. All tiers.
• IMPROVED Collapsible Data Sources panel: the Data Sources and AI Monitor Correlation cards now collapse/expand and remember their state per user (server-side, following you across reloads and machines), matching the Settings cards. All tiers.
• IMPROVED Cleaner Audit Activity in threat reports: the report's Audit Activity section now summarizes analyst status changes, remediations, and config changes by actor and action (so a bulk triage no longer floods the report with near-identical rows), shows the most-recent events as a preview with an accurate window total, and points to the shipped Athena saved query “Audit activity (who did what)” for the full row-by-row export. Advanced+.
• NEW Real-time dashboard totals: the Threat Overview donuts now show true whole-table counts by status and severity, kept live as threats are created and triaged — not a sample of the loaded page. A small “live totals” note shows when they were last reconciled and how many threats have been archived all-time. All tiers.
• NEW Server-side threat filtering & pagination: the Threats list filters by status and severity across the whole table (not just the loaded rows) and pages through results with Load more, backed by a new index so filtering is a direct lookup rather than a table scan. Search, type, time and assignee still refine the loaded page. This resolves the old “partial view” cap where filters and counts only reflected a sample. All tiers.
• NEW Automatic threat retention & archive: a daily pass retires old threats from the live list — handled threats after a grace window, anything past a hard age cap, and (as a ceiling) the oldest/lowest-severity when the live count runs high — while keeping the dashboard totals exact and recording every removal in the tamper-evident audit trail. The forensic copy in the datalake and the audit archive keep their own longer retention; only the live operational store is pruned. Tunable under Settings → Threat Retention & Archive (with range checks), monitored with CloudWatch alarms (large batches, active-threat evictions, errors) and its own dashboard row, and safe on very large tables (self-continuing, with a mass-delete circuit breaker). All tiers.
• IMPROVED Faster threat triage: applying a status (single or bulk, e.g. marking a group false-positive) now writes directly and in parallel instead of one round-trip per threat, so triaging a batch is markedly quicker. The active filters in the Threats toolbar are also highlighted so it's clear at a glance which ones are narrowing the list. All tiers.
• NEW AI group tuning: on an expanded group of similar threats, ✨ Analyze asks AI to assess whether they're false positives and propose a rule exclusion to stop the noise, shown with the deterministic facts they share. Two explicit actions follow — apply the exclusion (opens the rule for review, then Save, fully audited) and mark the group false-positive — so triage and tuning happen in one place. Suggestion only and exclusion-only: it can never broaden a rule or open a blind spot, and a human approves every change. Requires custom rules + Bedrock (advanced+).
• NEW Built-in rule exclusions: every built-in detection (root usage, trail/Config tampering, public bucket, wildcard policy, credential stuffing, impossible travel, port scanning) can now carry exclusions — if a condition matches (e.g. deploys from your office CIDR, a known service principal), that rule does not fire. Edit them per rule under Detection Rules, or click “(exclude this)” on a built-in-fired threat to add one pre-filled from the threat, for review then Save. Suppresses only (never hides a real anomaly — the behavioral baseline still scores independently), audited, and available on all tiers. Source-IP exclusions work on flow-log rules too.
• NEW Assess a rule with AI: in the custom-rule builder, ✨ Assess sanity-checks the rule you're editing — does it do what its name says, is it too broad, redundant, or trying to express something the event fields can't (e.g. cross-account comparisons)? The critique is grounded in a field-capability contract (each field's type, valid values, and impossible comparisons) plus deterministic checks, so structural facts don't depend on the model. Advisory only: nothing changes, you decide. Requires custom rules + Bedrock (advanced+).
• IMPROVED Expanded ML behavioral baselines: the per-principal model now spans nine behavioral dimensions, adding region novelty, resource-service novelty, and principal identity type alongside the existing API, time, IP, error, and write signals. All tiers. Baselines re-learn once on upgrade to the new model, then continue online.
• NEW Context-aware severity modifiers (advanced+): a matched rule scores higher when the actor is the root principal or the source IP is outside your configured trusted networks. Modifiers only raise a score, never suppress one, and never key on the ML anomaly signal (no double-counting). The untrusted-IP modifier is inert until you set severityModifiers.trustedIps.
• NEW Threat detail redesigned with Summary and Details tabs: Summary is an at-a-glance triage view (key facts, description, assignment, and a quick overview); Details holds the full evidence, timeline, correlated events, audit history, and playbook. All tiers.
• NEW Analyst notes on threats: add free-text notes as you work an incident. Notes are append-only, shown in the threat's Audit History alongside status changes and remediations, and recorded in the tamper-evident audit trail. All tiers (admin/analyst).
• NEW Threat assignment: admins can assign a threat to any admin/analyst or claim it; analysts can claim it for themselves. The Threats toolbar adds an admin “Assigned to” filter and an “Assigned to me” toggle. Every assignment is audited. All tiers.
• NEW Time-window filter on the Threats list: narrow to the last 24 hours, 48 hours, week, month, 2 months, or older. Composes with the other filters and with bulk actions. All tiers.
• NEW Download incident report: export a self-contained, styled HTML report for a threat (facts, evidence, timeline, correlated identities, full audit trail, and playbook), including live links back to the threat and to any custom rule that fired. All tiers, all roles.
• NEW Jump to the rule that fired: on a threat, the rule that fired it is shown on the Summary tab and in Evidence as a link — a custom rule opens that rule in Detection Rules; a built-in rule (shown with a readable name) opens the built-in rules section — with a “Back to threat” breadcrumb. Any role can follow the link to view; editing still requires admin.
• NEW More custom-rule condition operators: added does-not-contain, does-not-exist, ends-with, the “or-equal” numeric comparisons (≥, ≤), and in-CIDR / not-in-CIDR for IP fields, alongside the existing set. The negated operators make exclusions (e.g. suppressing AWS service-to-service calls) straightforward. Requires custom rules (advanced+).
• IMPROVED Sigma import handles more rules: the importer now translates ends-with, numeric comparisons, CIDR matching, and exists modifiers, and an OR condition (selA or selB, or 1 of …) imports as several rules, one per branch. It remains a bounded translator that never silently mistranslates — regex, |all, and nested/AND-across-selection conditions are listed for you to add by hand (or describe them in plain English for the AI drafter). Requires custom rules (advanced+).
• IMPROVED Configurable retention per tier for threat timelines and the audit trail, plus S3 noncurrent-version expiration for the config bucket, so storage lifecycle matches each tier's retention story. See the retention table in Getting Started.
• NEW Cold log-retention override: the new DatalakeRetentionDays stack parameter lets you keep raw events and threat evidence in the S3 datalake (Athena-queryable) longer than your tier's default — e.g. 2555 for a 7-year policy — without a tier change. OpenSearch hot-search retention stays tier-governed, so cold retention scales independently of hot-index cost.

26h2 (August 2026)

Development milestone — August 10, 2026

• NEW AI Monitor correlation: metric anomalies are read from the shared OpenSearch domain and merged into threat timelines on the same resource and time window (advanced+). No producer changes; per-subscription opt-in in the editor Data Sources panel.
• NEW Log Processor pattern detections reach AI SIEM through AI Monitor: a per-pattern CloudWatch metric is baselined by AI Monitor, and a spike surfaces as a correlated timeline event.
• NEW On-demand flow query: VPC flow logs are captured to S3 continuously (ALL traffic; cheap), and an anomalous network-egress spike triggers a scoped Athena query over that data for the affected resource and window — full forensic detail at query cost, no VPC changes.
• NEW Flat-cost flow-log analysis: VPC flow logs are retained in S3 and analyzed by scheduled Athena sweeps, so cost scales with query cadence rather than traffic volume. CloudTrail/GuardDuty/Config ingestion is unaffected.
• NEW Scheduled Athena scan-sweep runs port-scan detection over the captured flow logs on a fixed cadence.
• NEW Initial release
• NEW CloudTrail ingestion with S3 event-driven processing
• NEW VPC Flow Log ingestion
• NEW GuardDuty + Security Hub finding ingestion via EventBridge
• NEW ML behavioral baselines per IAM principal (RCF)
• NEW Unified threat timeline with cross-signal correlation
• NEW MITRE ATT&CK mapping (advanced+)
• NEW AI-powered incident response playbooks via Bedrock (advanced+)
• NEW Threat intelligence IP enrichment (advanced+)
• NEW Compliance posture scoring (advanced+)
• NEW Auto-remediation: disable keys, revoke sessions, isolate instances (enterprise) — superseded in 26h3 by delegated SSM-Automation remediation (buyer-owned runbooks and role)
• NEW Editor UI with threat dashboard, timeline viewer, source management
• NEW Deploys on existing Log Processor VPC + OpenSearch (no new cluster)
• NEW 5-tier entitlement system via AWS Marketplace