Amazon GuardDuty Investigation Agent Public Preview Launches for Cloud Security
Amazon Web Services has released the public preview of the Amazon GuardDuty investigation agent, an AI-powered security tool designed to evaluate findings, correlate historical activity, and map threat telemetry across cloud environments. According to AWS, the new capability aims to reduce security investigation workflows from hours to minutes by synthesizing security finding metadata, 90-day activity logs, and affected resource topologies into structured analysis reports.
Did you know? Threat detection services continuously stream alerts regarding suspicious network or runtime behavior, but security teams frequently struggle with alert fatigue and the manual overhead required to correlate findings across fragmented accounts and logs.
Addressing the Core Security Bottleneck in AWS Accounts
Security teams often face overwhelming alert volumes during daily operations. Clarke Rodgers, who works in the Office of the CISO at AWS, framed the product thesis directly on LinkedIn by stating that security teams do not have a detection problem, but rather an investigation problem.
To solve this bottleneck, the GuardDuty investigation agent evaluates telemetry on demand across three distinct scopes, according to AWS documentation:
- Finding Analysis: Evaluates a specific 32-character GuardDuty finding ID, supporting all Extended Threat Detection findings and select foundational, S3, and Runtime findings during the preview.
- Account Analysis: Assesses the current threat posture of an individual 12-digit AWS account.
- Organization Analysis: Evaluates threat findings across up to 100 member accounts in an AWS Organization.
Structured Risk Ratings and Automated Response Pipelines
Each completed analysis yields a structured result set containing an overall risk rating ranging from Info to Critical, a confidence score, classification against the MITRE ATT&CK matrix, and actionable CLI remediation steps. AWS emphasizes that AI should assist the investigation rather than replace it, noting that human validation and decision-making are still essential before taking any remediation actions.
Programmatically, developers and SecOps teams can trigger investigations using standard AWS SDKs, the AWS CLI via aws guardduty create-investigation, or via EventBridge rules to automate downstream response pipelines. For example, teams can retrieve a region-specific detector ID and trigger an investigation with custom human context:
# Get your region-specific Detector ID
aws guardduty list-detectors --region us-east-1
# Trigger an investigation with custom human context
aws guardduty create-investigation
--region us-east-1
--detector-id 12abc34d567e8fa901bc2d34eexample
--trigger-prompt "Investigate finding 1ab2c3d4e5f6a7b8c9d0e1f2a3b4c5d6. Note: IP belongs to an internal VPN gateway."Data Compliance, Hyperscaler Comparison, and Preview Limits
To address data residency and compliance concerns associated with large language models, AWS leverages its Cross-Region Inference Service powered by underlying Bedrock models. While compute inference might route to another region within the same geographic boundary to optimize resource availability, AWS states that investigation data and generated reports remain stored within the originating home region.
This launch positions GuardDuty in a category the other hyperscalers entered earlier. Microsoft has shipped Security Copilot since 2024 for incident summarization and guided response across Defender and Sentinel, while Google offers Gemini-assisted investigation inside Security Operations. What distinguishes the GuardDuty agent is its scope rather than novelty, as it remains bounded to GuardDuty’s own finding corpus and surrounding AWS telemetry.
The GuardDuty investigation agent is currently available in public preview across 10 commercial AWS regions, including US East (N. Virginia, Ohio), US West (Oregon), Canada (Central), Europe (Frankfurt, Ireland, London, Paris, Stockholm), and Asia Pacific (Tokyo). Usage is free during the preview period, subject to a throttle limit of 10 investigations per account per day, capped at a cumulative maximum of 100 per account.
Pro Tip: The preview limits of 10 investigations per day and 100 overall are tailored for manual triage and prototyping rather than high-volume automated response pipelines. Security analysts should evaluate the outputs manually to understand how the agent structures risk data before building out extensive EventBridge workflows.
Frequently Asked Questions
What is the Amazon GuardDuty investigation agent?
It is an AI-powered security tool that evaluates findings, correlates historical activity, and maps threat telemetry across AWS accounts and organizations to speed up incident analysis.
What scopes does the investigation agent support?
According to AWS, the agent supports finding analysis for specific finding IDs, account analysis for individual 12-digit accounts, and organization analysis across up to 100 member accounts.
How is data residency maintained during an investigation?
AWS utilizes its Cross-Region Inference Service for compute needs, but ensures that investigation data and generated reports remain stored within the originating home region.
Is the preview version free to use?
Yes, usage is free during the public preview period, though it is subject to a throttle limit of 10 investigations per account per day and a cumulative cap of 100 per account.
Join the Discussion: How do you plan to incorporate AI-driven investigation tools into your cloud security workflows? Share your thoughts in the comments below, explore our latest cloud security guides, or subscribe to our newsletter for weekly updates.
Keep reading