AWS GuardDuty Automates Threat Investigations with New AI Agent
Amazon GuardDuty's new AI-powered investigation agent, now in public preview, automates initial threat investigation steps, significantly reducing response times for security teams.
Amazon Web Services (AWS) has launched a public preview of a new AI-powered investigation agent for its GuardDuty threat detection service. This innovative feature aims to automate the initial stages of threat investigations, a critical and often time-consuming process for security teams. By leveraging artificial intelligence, the agent can analyze GuardDuty findings across AWS accounts and entire organizations, providing structured assessments, risk levels, and actionable recommendations.
The investigation agent is designed to streamline the workflow for security professionals, allowing them to quickly understand the scope and severity of potential threats. Instead of manually correlating data and assessing risks, teams can rely on the agent's AI capabilities to generate comprehensive reports. These reports include detailed summaries, mappings to the MITRE ATT&CK framework, identification of affected AWS resources, confidence scores for the findings, and prioritized remediation steps. This automation is expected to significantly reduce the mean time to investigate (MTTI) and, consequently, the mean time to respond (MTTR).
During the public preview phase, the investigation agent is available at no additional cost to users in 10 AWS Regions. AWS has implemented usage limits to manage the preview, restricting accounts to 10 investigations per day and a cumulative total of 100 investigations during the preview period. Importantly, investigations that fail to complete do not count against these quotas, ensuring that users can experiment without penalty.
To enable and utilize the investigation agent, Amazon GuardDuty must first be enabled for the AWS organization. The feature requires three new permissions to be configured: one for creating investigations, another for retrieving investigation results, and a third for listing investigations associated with a detector. Administrator accounts have broad access, able to create, retrieve, and view investigations for their own accounts and any member accounts within their organization. Member accounts, however, are restricted to retrieving and viewing investigations solely for their own account, lacking the ability to initiate new investigations or access those belonging to other accounts.
Investigations can be initiated directly from the GuardDuty console. Users have the flexibility to start an investigation for a specific finding, a particular AWS account, or the entire organization. The results, once processed, are accessible via the AWS Command Line Interface (CLI) and Software Development Kits (SDK) through dedicated APIs like CreateInvestigation, GetInvestigation, and ListInvestigations. The CLI also supports natural-language prompts, further simplifying the process of querying for specific threats or organizational security postures.
AWS has emphasized the API-first design of this feature, enabling organizations to integrate automated investigations into their existing security workflows. This integration can enrich GuardDuty findings with correlated evidence, detailed threat assessments, and recommended actions. Furthermore, the investigation agent integrates with Amazon EventBridge, allowing for the seamless forwarding of enriched GuardDuty findings—including risk scores, confidence assessments, MITRE ATT&CK mappings, and remediation guidance—to Security Information and Event Management (SIEM) platforms, ticketing systems, and other automation tools.
Beyond its direct integration capabilities, the GuardDuty investigation agent also supports advanced AI workflows through the Model Context Protocol (MCP). This open standard allows AI assistants, such as Anthropic's Claude, to securely connect to external data sources and tools. By using the official AWS MCP server, organizations can leverage AI-powered workflows that incorporate the insights generated by GuardDuty investigations, further enhancing their security posture and response capabilities.
It is important to note that the GuardDuty investigation agent is specifically designed for GuardDuty findings and operates independently of other AWS agents like the AWS Security Agent and AWS DevOps Agent. The agent utilizes AWS's cross-Region inference capability to analyze findings, with inference requests potentially processed in another AWS Region within the same geographic area, while ensuring data remains encrypted in transit.