AI SIEM — Changelog

26h4b (October 2026)

Available on AWS Marketplace

• NEW Choose your AI model. An admin can select the Amazon Bedrock model used for playbooks and report summaries under Settings → AI — pick from a recommended list (each shows its relative cost), click Test this model to confirm it produces a usable playbook, then Apply and save, or revert to the deployment default. The change applies with no stack update. Apply unlocks only after a successful Test, so an untested model can never go live.
• NEW Works in every region. The AI model is now invoked through the inference profile matching your deployment's region (US, Europe, Asia-Pacific), so playbook and report AI work correctly outside us-east-1. Enter a base model id and AI SIEM applies the right regional form automatically.
• NEW Model-retirement warnings. When the model in use nears its AWS retirement date, the FAQ panel shows an advance warning so you can switch to a successor before it stops working. If a model is ever unavailable, AI SIEM falls back to a built-in deterministic playbook and explains why.
• NEW Notification bell for background playbooks. A slower model can take longer than a request should wait; when that happens, playbook generation continues in the background and a notification bell lights with a link to the threat the moment it's ready — no more watching a spinner.
• IMPROVED Reliable playbooks on any model. AI SIEM now adapts to how each Bedrock model formats and paces its output, so playbooks generate dependably whether you run a fast model (Claude Haiku) or a slower, more detailed one (Claude Sonnet). It automatically handles longer responses, gives a slower model more time when it needs it, and remembers what works for each model so later playbooks are quick — and if a model still can't produce usable steps, you always get a built-in playbook rather than an empty result. The model that generated each playbook is now shown on the playbook and on the dashboard.
• IMPROVED Faster configuration saves. Saving no longer runs a live model check, so changes save immediately; the “does this model work” guarantee moved to the Test this model button in Settings → AI.
• IMPROVED Clearer AI failure messages. Playbook and report AI failures now name the likely cause and the one action that fixes it — enable model access, choose a faster model, or (for a brand-new model your account isn't yet entitled to) contact AWS — instead of a generic error.
• IMPROVED Report preview shows a loading state. Opening a report preview now shows “Loading preview…” while it fetches, instead of a blank panel.
• IMPROVED Click the AI SIEM title to return to the dashboard.

26h4a — General Availability (October 2026)

Now available on AWS Marketplace

• NEW Generally available. First GA release of AI SIEM: AI-powered Security Information and Event Management for AWS, deployed into your own account via AWS Marketplace.
• NEW Unified threat detection & timeline. Correlates CloudTrail, VPC Flow Logs, GuardDuty, Security Hub, and AWS Config into a chronological threat timeline per actor, with ML behavioral baselines per IAM principal and MITRE ATT&CK mapping.
• NEW Guided incident response. On-demand, AI-generated response playbooks (Amazon Bedrock) with identifier de-identification before the model, and optional delegated remediation through buyer-owned AWS Systems Manager Automation runbooks.
• NEW Multi-account & multi-environment. A single deployment can centralize logs, metrics, and threats across your AWS organization; run separate dev/staging/prod instances side by side.
• IMPROVED Dashboard clarity. The “By severity” view now reflects open (needs-attention) threats, so handled items don’t inflate the picture.
• IMPROVED Security & reliability hardening. Browser security headers/CSP on the editor, flat-cost Athena-first flow-log analysis, and resiliency/DR validation ahead of GA.

Release history

Condensed summary of pre-GA development milestones

• 26h4 (Oct 2026) — AI Monitor metric anomalies can raise standalone threats; at-a-glance threat lifecycle trail; Athena-first flat-cost flow-log analysis; editor security response headers/CSP; bulk-action and Data Sources UX improvements; detection-noise and compliance-tally fixes.
• 26h3 (Sep 2026) — Delegated remediation via buyer-owned SSM Automation (replacing self-privileged auto-remediation), with staged approval, scheduling, and an SLA/stalled watchdog; dedicated VPC Flow panel; point-and-click Investigations over the long-retention archive; Bedrock privacy mode (identifier redaction, encrypted mapping); per-VPC flow thresholds.
• 26h2 (Aug–Sep 2026) — Initial build: CloudTrail / VPC Flow / GuardDuty / Security Hub ingestion; ML behavioral baselines per IAM principal; unified threat timeline with cross-signal correlation; MITRE ATT&CK mapping; AI playbooks; editor UI with dashboard, triage, bulk assignment, per-detection email alerts, autosave/recovery; real-time dashboard totals, server-side filtering/pagination, and automatic threat retention/archive; AI Monitor & Log Processor correlation; 5-tier Marketplace entitlement.

Full, granular per-change history is retained internally and available on request.