AWS Launches Amazon GuardDuty Investigation Agent to Automate Threat Triage

AWS launched the public preview of Amazon GuardDuty investigation agent, an AI-powered security tool that evaluates findings, correlates historical activity, and maps threat telemetry across AWS accounts and organizations to reduce security investigation workflows from hours to minutes. The tool synthesizes security finding metadata, 90-day activity logs, and affected resource topologies into structured analysis reports, supporting three scopes: finding analysis, account analysis, and organization analysis. AWS Security Hero Sena Yakut cautioned that AI should assist but not replace human validation before remediation actions.

AWS recently released the public preview of the Amazon GuardDuty investigation agent https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-investigation.html , an AI-powered security tool that evaluates findings, correlates historical activity, and maps threat telemetry across AWS accounts and organizations. The company designed the tool to reduce security investigation workflows from hours to minutes by synthesizing security finding metadata, 90-day activity logs, and affected resource topologies into structured analysis reports. AWS announced the capability https://aws.amazon.com/about-aws/whats-new/2026/06/amazon-guardduty/ in June as AI-powered investigations and published a detailed walkthrough https://aws.amazon.com/blogs/security/introducing-the-amazon-guardduty-investigation-agent-on-demand-ai-powered-threat-assessment/ in July under the investigation agent name. Threat detection services like Amazon GuardDuty https://docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html continuously stream alerts regarding suspicious network or runtime behavior. However, security teams frequently struggle with alert fatigue and the manual overhead required to correlate findings across fragmented accounts and logs. Clarke Rodgers, who works in the Office of the CISO at AWS, framed the product thesis directly on LinkedIn https://www.linkedin.com/posts/clarkerodgers introducing-the-amazon-guardduty-investigation-activity-7485118406665437184-x7r7/ : Security teams don't have a detection problem. They have an investigation problem. The GuardDuty investigation agent addresses that bottleneck by evaluating telemetry on demand across three distinct scopes: - Finding Analysis: Evaluates a specific 32-character GuardDuty finding ID. During preview, it supports all Extended Threat Detection XTD findings and select foundational, S3, and Runtime findings. - Account Analysis: Assesses the current threat posture of an individual 12-digit AWS account. - Organization Analysis: Evaluates threat findings across up to 100 member accounts in an AWS Organization. Each completed analysis yields a structured result set containing an overall risk rating ranging from Info to Critical , a confidence score, classification against the MITRE ATT&CK matrix https://attack.mitre.org/ , and actionable CLI remediation steps. Sena Yakut, a cloud security architect and AWS Security Hero, drew the distinction https://aws.plainenglish.io/why-i-keep-recommending-amazon-guardduty-c3ec98563a15 between the agent and GuardDuty's existing correlation capability: Extended Threat Detection connects related findings into an attack sequence, while Investigation analyzes the affected resources, IAM activity, and surrounding context to generate a summary with recommended next steps. She sees the strongest fit in organizations without a large security function, where initial evidence-gathering consumes a disproportionate share of analyst time, and tested it against sample findings, which returned low risk ratings on test resources as expected. Her caveat is the one that matters for teams wiring this into a response process: Of course, AI should assist the investigation, not replace it. Human validation and decision-making are still essential before taking any remediation actions. Programmatically, developers and SecOps teams can trigger investigations using standard AWS SDKs, the AWS CLI via aws guardduty create-investigation, or via EventBridge rules to automate downstream response pipelines. Get your region-specific Detector ID aws guardduty list-detectors --region us-east-1 Trigger an investigation with custom human context aws guardduty create-investigation \ --region us-east-1 \ --detector-id 12abc34d567e8fa901bc2d34eexample \ --trigger-prompt "Investigate finding 1ab2c3d4e5f6a7b8c9d0e1f2a3b4c5d6. Note: IP belongs to an internal VPN gateway." The MCP integration is the key detail for teams already running agentic tooling. Through the AWS MCP Server, an engineer can trigger a threat investigation from Claude Desktop or a custom CLI agent runner using existing AWS Identity and Access Management IAM credentials, which places security investigation inside the same agent surface as code and infrastructure work. It also inherits the governance questions that come with it: which principal actually ran the investigation, whether the agent's context window now holds 90 days of correlated security telemetry, and how that transcript is retained. AWS's own Loom reference platform https://www.infoq.com/news/2026/07/loom-aws-agent-platform/ , released the same month, exists precisely to answer that class of question for agent deployments. To address data residency and compliance concerns associated with LLMs, AWS leverages its Cross-Region Inference Service https://docs.aws.amazon.com/bedrock/latest/userguide/cross-region-inference.html CRIS powered by underlying Bedrock models. While compute inference might route to another region within the same geographic boundary to optimize resource availability, AWS states that investigation data and generated reports remain stored within the originating home region. The launch puts GuardDuty in a category the other hyperscalers entered first. Microsoft has shipped Security Copilot https://learn.microsoft.com/en-us/copilot/security/microsoft-security-copilot since 2024 for incident summarization and guided response across Defender and Sentinel, and Google offers Gemini-assisted investigation https://docs.cloud.google.com/cloud-assist/create-investigation inside Security Operations. What distinguishes the GuardDuty agent is scope rather than novelty: it is bounded to GuardDuty's own finding corpus and the surrounding AWS telemetry rather than positioned as a general security assistant, which narrows what it can reason about while making its outputs easier to validate against a known data set. The GuardDuty investigation agent is currently available in public preview across 10 commercial AWS regions: US East N. Virginia, Ohio , US West Oregon , Canada Central , Europe Frankfurt, Ireland, London, Paris, Stockholm , and Asia Pacific Tokyo . Usage is free during the preview period, subject to a throttle limit of 10 investigations per account per day, capped at a cumulative maximum of 100 per account during the preview phase. Failed investigations do not count toward either quota. Those limits sit awkwardly beside the EventBridge integration. Ten investigations per account per day, capped at 100 for the whole preview, is a budget for manual triage rather than automated response pipelines, so teams can prototype the wiring but not yet run it at alert volume. That constraint aligns with Yakut's caveat: the preview is scoped for analysts evaluating the output, not for systems acting on it.