Automation / DevOps / IaC

Researchers introduce Sigma-Hunter, a domain-adapted LLM designed to help detection engineers translate threat reports and forensic observations into valid Sigma rules. Unlike general-purpose models that often produce invalid YAML or incorrect logic, this model is fine-tuned on a curated dataset of 3,635 validated open-source rules expanded into over 7,600 examples. The team trained both a 7B Mistral and a Phi model to ensure strict adherence to detection engineering constraints without data leakage across splits.

• Addresses common LLM failures like invalid YAML and unsupported fields in Sigma rules.
• Trained on 7,663 QA examples derived from 3,635 validated open-source rules.
• Ensures no data leakage by partitioning source rules before expansion.
• Available for both Mistral 7B and Phi architectures for flexible deployment.

AWS Batch now emits native CloudWatch metrics for job state transitions and duration, enabling direct visibility into batch workload health. These metrics cover the entire lifecycle, including submission to runnable times and total execution duration, tagged with the JobQueueName dimension. Users can access this data via the AWS Batch console, CloudWatch console, or through standard CLI and SDK integrations.

• Native CloudWatch metrics eliminate the need for custom logging pipelines to track batch job health.
• State transition metrics allow precise monitoring of job flow through submitted, running, and failed states.
• Duration metrics provide granular visibility into latency between submission, runnable status, and completion.
• Metrics are automatically tagged with JobQueueName, simplifying aggregation and alerting per queue.

AWS Batch now authenticates to Amazon EKS clusters using the API-driven access entry mechanism instead of relying solely on the aws-auth ConfigMap. This change simplifies cluster setup and lifecycle management by allowing IAM principals to be granted access programmatically. Users can enable this feature via the CreateComputeEnvironment or UpdateComputeEnvironment APIs by setting the accessEntry.desiredState to ENABLED.

• Eliminates manual ConfigMap management for Batch-to-EKS auth
• Enable via API by setting accessEntry.desiredState to ENABLED
• AWS Batch creates one access entry per cluster automatically
• Associates AWSBatchClusterPolicy with the new access entry
• Use CLI, SDKs, or Console to configure access entries

cmux is an open-source terminal built on Ghostty that introduces vertical tabs and system-level notifications specifically for AI coding agents. It provides a notification panel to aggregate pending agent alerts and includes an in-app browser for splitting views alongside the terminal. The tool emphasizes multitasking and programmability for developers managing multiple AI interactions.

• Vertical tabs improve screen real estate when managing many concurrent AI agent sessions.
• Notification rings and a central panel reduce context-switching overhead for developers.
• Built on Ghostty, leveraging its performance while adding agent-specific UI features.
• In-app browser support allows splitting terminal and web views for easier reference.
• Targeted workflow optimization for macOS users heavily relying on AI coding assistants.

AWS Control Tower Account Factory for Terraform now supports plan-only customization runs, allowing administrators to preview Terraform changes before applying them. Previously, triggering customizations always executed a full apply, making it hard to validate outcomes or detect drift. This new capability enables safe pre-rollout validation and integration into CI/CD pipelines without altering the live environment.

• Preview Terraform plans for global and account customizations without applying changes.
• Reduce risk of unintended configuration drift during broad rollout phases.
• Integrate AFT customizations into CI/CD workflows for safer automated deployments.
• Validate expected outcomes of Terraform modules before committing to production.

AWS Continuum for Penetration Testing has entered public preview with native support for CI/CD integration. This update shifts security testing left by embedding penetration tests directly into deployment workflows, moving validation from post-deployment to deploy-time. Developers now receive immediate findings on severity and affected endpoints within their existing build systems.

• Native CI/CD integration enables continuous penetration testing as a deploy-time event
• Eliminates need for third-party vendor contracts for routine security validation
• Shifts security testing left to align with daily code shipping workflows
• Public preview status available now for immediate integration testing