AWS Launches Amazon GuardDuty Investigation Agent to Automate Threat Triage
AWS just shipped an AI agent that automates security threat triage. It's live in preview—10 investigations per account per day.
Why it matters
AWS is embedding agentic AI into core security workflows via GuardDuty, enabling enterprises to automate threat investigation at scale. This signals how cloud providers are moving beyond model APIs to shipping AI-native products that directly reduce MTTR (mean time to resolution) in security operations.
The key facts
6 to knowGuardDuty Investigation Agent in public preview
Correlates 90-day activity logs and resource topologies
Risk ratings, confidence scores, MITRE ATT&CK classification included
Accessible via AWS MCP Server for agentic tooling
Preview quota: 10 investigations per account per day
Structured reporting capability
Go to the source
InfoQ AI/MLinfoq.com
Publisher excerpt: AWS released a public preview of the GuardDuty investigation agent, which correlates findings, 90-day activity logs, and resource topologies into structured reports with risk ratings, confidence scores, and MITRE ATT&CK classification. It is reachable through the AWS MCP Server, so investigations…