AWS GuardDuty: Automate Threat Investigation to Streamline Security Operations

Post Views: 17

AWS has introduced a new feature to automate initial stages of threat investigations through its GuardDuty service.

AWS Expands GuardDuty Capabilities with Automated Threat Investigation Agent

Amazon Web Services has introduced a new feature to automate initial stages of threat investigations through its GuardDuty service. The GuardDuty investigation agent is now available in public preview, offering AI-driven analysis of security findings across AWS accounts and organizations. This tool aims to streamline the process of identifying and addressing potential threats by providing structured assessments, risk evaluations, and actionable insights. During the preview phase, the investigation agent is offered at no additional cost in 10 AWS regions. Users are limited to 10 investigations per account daily, with a total cap of 100 investigations per account throughout the preview period. Failed attempts do not count toward these limits. The feature is designed to complement Amazon GuardDuty, a managed threat detection service that continuously monitors AWS environments for malicious activity, generating findings for further analysis.

Key Features and Functionality

The investigation agent enables security teams to conduct detailed assessments of individual security findings or evaluate the overall security posture of an organization. It generates structured reports that include risk levels, confidence scores, and recommendations for remediation. According to Allan Holmes, a senior specialist at AWS, the tool simplifies complex investigations by providing a standardized framework for analyzing threats.

According to Allan Holmes, a senior specialist at AWS, the tool simplifies complex investigations by providing a standardized framework for analyzing threats.

To activate the investigation agent, GuardDuty must be enabled for the AWS organization. Three new permissions are required to create investigations, retrieve results, and list investigations for a detector. Administrator accounts can initiate investigations, access results, and view data for both their own and member accounts. Member accounts are restricted to retrieving and viewing investigations specific to their own accounts. When investigating a particular member account, an account ID is mandatory, but this is unnecessary for assessments of the administrator account or the entire organization.

Integration and Workflow

Investigations can be initiated through the GuardDuty console for specific findings, individual accounts, or entire organizations. Results include summaries, mappings to MITRE ATT&CK techniques, details on affected AWS resources, and risk and confidence assessments. The feature is also accessible via the AWS Command Line Interface (CLI) and Software Development Kit (SDK) using APIs such as CreateInvestigation, GetInvestigation, and ListInvestigations. Since investigations are processed asynchronously, users submit requests and retrieve results once processing is complete. The CLI supports natural-language prompts to simplify the initiation of investigations. AWS emphasizes the API-first design, which allows organizations to embed automated investigations into existing security workflows, enhancing GuardDuty findings with correlated evidence and threat intelligence.

AI Integration and Cross-Region Analysis

The investigation agent leverages AWS’s cross-region inference capabilities to analyze findings and generate structured assessments. Inference requests may be processed in another region within the same geographic area, with data encrypted during transit. Each investigation returns a risk level, confidence score, summary, and detailed findings. Additionally, the tool integrates with AI assistants via the Model Context Protocol (MCP), an open standard enabling secure connections between AI systems and external data sources. AWS’s MCP server allows organizations to incorporate GuardDuty investigations into AI-powered workflows using compatible clients like Kiro and Anthropic’s Claude.

Technical Implementation

When an investigation begins, the GuardDuty agent analyzes findings across regions, ensuring data remains protected during transmission. The output includes risk assessments, confidence metrics, and actionable steps for mitigation. This approach reduces manual effort while maintaining alignment with industry frameworks such as MITRE ATT&CK. The introduction of the investigation agent reflects AWS’s ongoing efforts to enhance threat detection and response capabilities, addressing the growing complexity of cloud security challenges. By automating initial investigative steps, the tool aims to improve efficiency and accuracy in identifying and mitigating threats within AWS environments.