Question

A company runs production microservices on Amazon EKS. The security team wants to detect runtime threats inside containers, such as processes connecting to known cryptomining domains or containers escaping to the host, while minimizing operational overhead. They already have GuardDuty enabled with foundational data sources. What is the MOST operationally efficient way to achieve container-level runtime threat detection?

Accepted Answer

Enable GuardDuty Runtime Monitoring for EKS and use automated agent management so GuardDuty deploys and maintains the security agent on the cluster nodes.

Answer

Deploy a third-party host-based IDS as a DaemonSet on every node and forward alerts to Security Hub through a custom Lambda integration.

Answer

Enable VPC Flow Logs on the EKS worker node subnets and build CloudWatch Logs Insights queries to identify connections to malicious domains.

Answer

Enable GuardDuty EKS Audit Log Monitoring only, which inspects Kubernetes control plane API activity for suspicious runtime behavior inside containers.