AWS GuardDuty Investigation Agent Automates Threat Triage

AWS Launches AI-Powered Security Investigation Tool

Amazon Web Services has introduced the Amazon GuardDuty investigation agent, now available in public preview. This AI-powered security tool evaluates findings, correlates historical activity, and maps threat telemetry across AWS accounts and organizations.

The company designed the tool to reduce security investigation workflows from hours to minutes. It synthesizes security finding metadata, 90-day activity logs, and affected resource topologies into structured analysis reports. AWS announced the capability in June as AI-powered investigations and published a detailed walkthrough in July under the investigation agent name.

Addressing the Investigation Problem

Threat detection services like Amazon GuardDuty continuously stream alerts about suspicious network or runtime behavior. However, security teams often struggle with alert fatigue and the manual overhead required to correlate findings across fragmented accounts and logs. Clarke Rodgers, who works in the Office of the CISO at AWS, framed the product thesis directly on LinkedIn:

Security teams don't have a detection problem. They have an investigation problem.

The GuardDuty investigation agent addresses that bottleneck by evaluating telemetry on demand across three distinct scopes:

• Finding Analysis: Evaluates a specific 32-character GuardDuty finding ID. During preview, it supports all Extended Threat Detection (XTD) findings and select foundational, S3, and Runtime findings.
• Account Analysis: Assesses the current threat posture of an individual 12-digit AWS account.
• Organization Analysis: Evaluates threat findings across up to 100 member accounts in an AWS Organization.

Each completed analysis yields a structured result set containing an overall risk rating (ranging from Info to Critical), a confidence score, classification against the MITRE ATT&CK matrix, and actionable CLI remediation steps.

Expert Perspectives on the Agent

Sena Yakut, a cloud security architect and AWS Security Hero, drew the distinction between the agent and GuardDuty's existing correlation capability. Extended Threat Detection connects related findings into an attack sequence, while Investigation analyzes the affected resources, IAM activity, and surrounding context to generate a summary with recommended next steps. She sees the strongest fit in organizations without a large security function, where initial evidence-gathering consumes a disproportionate share of analyst time. She tested it against sample findings, which returned low risk ratings on test resources as expected. Her caveat is the one that matters for teams wiring this into a response process:

Of course, AI should assist the investigation, not replace it. Human validation and decision-making are still essential before taking any remediation actions.

Programmatic Integration and MCP Support

Programmatically, developers and SecOps teams can trigger investigations using standard AWS SDKs, the AWS CLI via aws guardduty create-investigation, or via EventBridge rules to automate downstream response pipelines.

# Get your region-specific Detector ID
aws guardduty list-detectors , region us-east-1

# Trigger an investigation with custom human context
aws guardduty create-investigation \
  , region us-east-1 \
  , detector-id 12abc34d567e8fa901bc2d34eexample \
  , trigger-prompt "Investigate finding 1ab2c3d4e5f6a7b8c9d0e1f2a3b4c5d6.

Note: IP belongs to an internal VPN gateway."

The MCP integration is the key detail for teams already running agentic tooling. Through the AWS MCP Server, an engineer can trigger a threat investigation from Claude Desktop or a custom CLI agent runner using existing AWS Identity and Access Management (IAM) credentials. This places security investigation inside the same agent surface as code and infrastructure work. It also inherits the governance questions that come with it: which principal actually ran the investigation, whether the agent's context window now holds 90 days of correlated security telemetry, and how that transcript is retained. AWS's own Loom reference platform, released the same month, exists precisely to answer that class of question for agent deployments.

Data Residency and Compliance

To address data residency and compliance concerns associated with LLMs, AWS leverages its Cross-Region Inference Service (CRIS) powered by underlying Bedrock models. While compute inference might route to another region within the same geographic boundary to optimize resource availability, AWS states that investigation data and generated reports remain stored within the originating home region.

Competitive Landscape

The launch puts GuardDuty in a category the other hyperscalers entered first. Microsoft has shipped Security Copilot since 2024 for incident summarization and guided response across Defender and Sentinel, and Google offers Gemini-assisted investigation inside Security Operations. What distinguishes the GuardDuty agent is scope rather than novelty. It is bounded to GuardDuty's own finding corpus and the surrounding AWS telemetry rather than positioned as a general security assistant, which narrows what it can reason about while making its outputs easier to validate against a known data set.

Preview Availability and Limits

The GuardDuty investigation agent is currently available in public preview across 10 commercial AWS regions: US East (N. Virginia, Ohio), US West (Oregon), Canada (Central), Europe (Frankfurt, Ireland, London, Paris, Stockholm), and Asia Pacific (Tokyo). Usage is free during the preview period, subject to a throttle limit of 10 investigations per account per day, capped at a cumulative maximum of 100 per account during the preview phase. Failed investigations do not count toward either quota.

Those limits sit awkwardly beside the EventBridge integration. Ten investigations per account per day, capped at 100 for the whole preview, is a budget for manual triage rather than automated response pipelines. Teams can prototype the wiring but not yet run it at alert volume. That constraint aligns with Yakut's caveat: the preview is scoped for analysts evaluating the output, not for systems acting on it.

Related on Neura Market

• AI Tools Directory
• Automation Marketplace
• Cloud Security Platform Directory