AI SIEM — Changelog

AI SIEM 26h4a is now generally available on AWS Marketplace. This is the first GA release — a production-ready, serverless SIEM that deploys into your own AWS account. The notes below summarize what the product does today and the milestones that led here.

26h4a — General Availability (October 2026)

Now available on AWS Marketplace

NEW Generally available. First GA release of AI SIEM: AI-powered Security Information and Event Management for AWS, deployed into your own account via AWS Marketplace.

NEW Unified threat detection & timeline. Correlates CloudTrail, VPC Flow Logs, GuardDuty, Security Hub, and AWS Config into a chronological threat timeline per actor, with ML behavioral baselines per IAM principal and MITRE ATT&CK mapping.

NEW Guided incident response. On-demand, AI-generated response playbooks (Amazon Bedrock) with identifier de-identification before the model, and optional delegated remediation through buyer-owned AWS Systems Manager Automation runbooks.

NEW Multi-account & multi-environment. A single deployment can centralize logs, metrics, and threats across your AWS organization; run separate dev/staging/prod instances side by side.

IMPROVED Dashboard clarity. The “By severity” view now reflects open (needs-attention) threats, so handled items don’t inflate the picture.

IMPROVED Security & reliability hardening. Browser security headers/CSP on the editor, flat-cost Athena-first flow-log analysis, and resiliency/DR validation ahead of GA.

Release history

Condensed summary of pre-GA development milestones

26h4 (Oct 2026) — AI Monitor metric anomalies can raise standalone threats; at-a-glance threat lifecycle trail; Athena-first flat-cost flow-log analysis; editor security response headers/CSP; bulk-action and Data Sources UX improvements; detection-noise and compliance-tally fixes.

26h3 (Sep 2026) — Delegated remediation via buyer-owned SSM Automation (replacing self-privileged auto-remediation), with staged approval, scheduling, and an SLA/stalled watchdog; dedicated VPC Flow panel; point-and-click Investigations over the long-retention archive; Bedrock privacy mode (identifier redaction, encrypted mapping); per-VPC flow thresholds.

26h2 (Aug–Sep 2026) — Initial build: CloudTrail / VPC Flow / GuardDuty / Security Hub ingestion; ML behavioral baselines per IAM principal; unified threat timeline with cross-signal correlation; MITRE ATT&CK mapping; AI playbooks; editor UI with dashboard, triage, bulk assignment, per-detection email alerts, autosave/recovery; real-time dashboard totals, server-side filtering/pagination, and automatic threat retention/archive; AI Monitor & Log Processor correlation; 5-tier Marketplace entitlement.

Full, granular per-change history is retained internally and available on request.