--- title: GuardDuty Runtime Monitoring is now included in the AWS... description: Amazon GuardDuty Runtime Monitoring, which detects container escapes, privilege escalation, and cryptomining on EC2, EKS, and ECS on Fargate, is now bundled... canonical: https://daily.dev/posts/guardduty-runtime-monitoring-is-now-included-in-the-aws-security-hub-threat-analytics-plan-xpx5ettai twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GuardDuty Runtime Monitoring is now included in the AWS Security Hub Threat Analytics plan | daily.dev og:description: Amazon GuardDuty Runtime Monitoring, which detects container escapes, privilege escalation, and cryptomining on EC2, EKS, and ECS on Fargate, is now bundled... og:url: https://daily.dev/posts/guardduty-runtime-monitoring-is-now-included-in-the-aws-security-hub-threat-analytics-plan-xpx5ettai og:image: https://api.daily.dev/og/posts/xPX5ETtAI.png og:image:alt: GuardDuty Runtime Monitoring is now included in the AWS Security Hub Threat Analytics plan og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GuardDuty Runtime Monitoring is now included in the AWS Security Hub Threat Analytics plan **[AWS](https://daily.dev/sources/aws)** · 2 min read · 0 upvotes · 0 comments ## Summary Amazon GuardDuty Runtime Monitoring, which detects container escapes, privilege escalation, and cryptomining on EC2, EKS, and ECS on Fargate, is now bundled into the AWS Security Hub Threat Analytics plan. Accounts with Security Hub enabled no longer get separate GuardDuty Runtime Monitoring charges; usage instead appears as a single Security Hub usage type spanning all three compute services. Detection coverage, finding types, and agents remain unchanged, and the Threat Analytics free trial stays separate from the Security Hub Essentials free trial. Billing impact can be checked via AWS Cost Explorer or the Security Hub usage page. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Will I still get a separate GuardDuty bill for Runtime Monitoring if I have Security Hub enabled? No, if Security Hub is enabled in an account and region, GuardDuty Runtime Monitoring charges no longer appear separately. Instead, usage across Amazon EC2, Amazon EKS, and Amazon ECS on AWS Fargate is billed under AWS Security Hub as a single usage type, as part of the Security Hub Threat Analytics plan. No reconfiguration is needed and detection coverage stays the same. _Track AWS billing changes like this one so cloud security costs don't catch your team off guard, via daily.dev._ ### Does bundling GuardDuty Runtime Monitoring into Security Hub Threat Analytics add a new free trial? No, the change does not add a new free trial for Runtime Monitoring. The Threat Analytics plan's free trial remains separate from the Security Hub Essentials plan's free trial, so merging the billing does not extend or combine trial periods. Teams can check the billing impact using AWS Cost Explorer or the Security Hub usage page. _daily.dev helps engineers stay current on AWS pricing shifts that affect security tooling budgets._ ## Similar posts on daily.dev - [Introducing Amazon GuardDuty AI Protection for AWS AI workloads](https://daily.dev/posts/introducing-amazon-guardduty-ai-protection-for-aws-ai-workloads-gyi6jo972) · AWS · 1 upvotes · 0 comments - [AWS Launches Amazon GuardDuty Investigation Agent to Automate Threat Triage](https://daily.dev/posts/aws-launches-amazon-guardduty-investigation-agent-to-automate-threat-triage-r0z3ja3bw) · InfoQ · 0 upvotes · 0 comments - [AWS Security Hub is now available in AWS GovCloud \(US\) Regions](https://daily.dev/posts/aws-security-hub-is-now-available-in-aws-govcloud-us-regions-k9uu478ys) · AWS · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#aws](https://daily.dev/tags/aws) [View this post on daily.dev](https://daily.dev/posts/guardduty-runtime-monitoring-is-now-included-in-the-aws-security-hub-threat-analytics-plan-xpx5ettai) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"GuardDuty Runtime Monitoring is now included in the AWS Security Hub Threat Analytics plan","url":"https://daily.dev/posts/guardduty-runtime-monitoring-is-now-included-in-the-aws-security-hub-threat-analytics-plan-xpx5ettai","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/guardduty-runtime-monitoring-is-now-included-in-the-aws-security-hub-threat-analytics-plan-xpx5ettai"},"datePublished":"2026-10-02T04:07:46.878Z","dateModified":"2026-10-02T04:08:07.243Z","description":"Amazon GuardDuty Runtime Monitoring, which detects container escapes, privilege escalation, and cryptomining on EC2, EKS, and ECS on Fargate, is now bundled...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2587ee7271b19b73b7c9d67f739e4290?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2587ee7271b19b73b7c9d67f739e4290?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"AWS","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"AWS","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/aws","url":"https://daily.dev/sources/aws"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/guardduty-runtime-monitoring-is-now-included-in-the-aws-security-hub-threat-analytics-plan-xpx5ettai","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,aws","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"AWS","item":"https://daily.dev/sources/aws"},{"@type":"ListItem","position":3,"name":"GuardDuty Runtime Monitoring is now included in the AWS Security Hub Threat Analytics plan"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/guardduty-runtime-monitoring-is-now-included-in-the-aws-security-hub-threat-analytics-plan-xpx5ettai#faq","mainEntity":[{"@type":"Question","name":"Will I still get a separate GuardDuty bill for Runtime Monitoring if I have Security Hub enabled?","acceptedAnswer":{"@type":"Answer","text":"No, if Security Hub is enabled in an account and region, GuardDuty Runtime Monitoring charges no longer appear separately. Instead, usage across Amazon EC2, Amazon EKS, and Amazon ECS on AWS Fargate is billed under AWS Security Hub as a single usage type, as part of the Security Hub Threat Analytics plan. No reconfiguration is needed and detection coverage stays the same. Track AWS billing changes like this one so cloud security costs don't catch your team off guard, via daily.dev."}},{"@type":"Question","name":"Does bundling GuardDuty Runtime Monitoring into Security Hub Threat Analytics add a new free trial?","acceptedAnswer":{"@type":"Answer","text":"No, the change does not add a new free trial for Runtime Monitoring. The Threat Analytics plan's free trial remains separate from the Security Hub Essentials plan's free trial, so merging the billing does not extend or combine trial periods. Teams can check the billing impact using AWS Cost Explorer or the Security Hub usage page. daily.dev helps engineers stay current on AWS pricing shifts that affect security tooling budgets."}}]} ```