AWS Launches Amazon GuardDuty Investigation Agent to Automate Threat Triage

2026-07-28 · Source: InfoQ · Field: Technology & Digital — Cybersecurity & Data Privacy, Artificial Intelligence & Machine Learning, Cloud Computing & IT Infrastructure · Depth: Intermediate, short

Summary

AWS has launched the public preview of the Amazon GuardDuty investigation agent, an AI-powered security tool designed to automate threat triage. This agent evaluates security findings, correlates 90-day historical activity logs, and maps threat telemetry across AWS accounts and organizations, aiming to reduce investigation workflows from hours to minutes. It offers three scopes: Finding Analysis, Account Analysis, and Organization Analysis for up to 100 member accounts. Each analysis provides an overall risk rating, confidence score, classification against the MITRE ATT&CK matrix, and actionable CLI remediation steps. The agent is available in public preview across 10 commercial AWS regions, with free usage during this period, subject to a throttle of 10 investigations per account per day, capped at 100 total per account.

Key takeaway

For SecOps teams struggling with alert fatigue and manual threat triage, the Amazon GuardDuty investigation agent offers AI-powered correlation to accelerate initial evidence gathering. During its public preview, you can prototype automated response pipelines using EventBridge or CLI, but be mindful of the 10 investigations per account per day limit. Focus on evaluating the agent's structured analysis and recommended CLI steps, ensuring human validation remains central before implementing any remediation actions.

Key insights

The Amazon GuardDuty investigation agent automates security threat triage by correlating findings and logs across AWS accounts using AI.

Principles

• Security teams face an investigation, not a detection, problem.
• AI should assist, not replace, human security investigations.
• Contextual correlation across logs reduces alert fatigue.

Method

The agent evaluates a GuardDuty finding ID, AWS account, or AWS Organization (up to 100 accounts) by synthesizing 90-day activity logs and resource topologies to generate structured analysis reports.

In practice

• Trigger investigations via AWS SDKs, CLI, or EventBridge.
• Integrate with Claude Desktop or custom CLI agents via AWS MCP Server.
• Evaluate agent output for human validation before remediation.

Topics

• Amazon GuardDuty
• Threat Detection
• Security Automation
• AWS Security
• AI-powered Security
• Incident Response

Best for: CTO, VP of Engineering/Data, Executive, AI Security Engineer, Security Engineer, IT Professional

Related on AIssential

• AWS fleshes out Security Hub with AI workload protection, Microsoft Azure support — AWS is expanding its security services to cover multi-cloud environments and AI-specific threats, integrating these capabilities into Security Hub and GuardDuty.
• Scaling Security Alert Triage With Specialized Agents on Databricks — Specialized, context-aware AI agents significantly improve security alert triage accuracy and efficiency, especially for low-severity alerts.
• 13-hour AWS outage reportedly caused by Amazon's own AI tools — Agentic AI tools require robust access controls to prevent user-induced service disruptions.
• Creating a Security Agent with Cohere North and Wiz - Cohere — Integrating AI agents with cloud security platforms automates incident response, reducing manual effort and accelerating triage.
• How Anthropic's cybersecurity team built a threat detection platform with Claude Code — AI-powered platforms can automate security alert triage and accelerate investigations by integrating internal context.
• How Amazon Bedrock catches AI-generated phishing — AI-generated phishing requires behavioral analysis and contextual understanding beyond traditional surface-level email filters.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by InfoQ.