Amazon Web Services (AWS) has launched a public preview of its new Amazon GuardDuty investigation agent, a feature designed to automate the initial stages of threat investigations using AI. This agent aims to reduce the time security teams spend on investigations by providing structured assessments of GuardDuty findings, AWS accounts, and entire AWS organizations.
During the public preview, the investigation agent is available at no additional cost in ten AWS Regions. Usage is capped at ten investigations per account per day, with a cumulative limit of 100 investigations per account over the preview period. Failed investigations do not count against these quotas.
Amazon GuardDuty is a managed threat detection service that continuously monitors AWS accounts, workloads, and data for malicious activity, generating security findings for further action. The investigation agent builds on this by offering detailed assessments that include risk levels, confidence scores, and actionable recommendations, whether for a single suspicious finding or an organization-wide security posture assessment.
To utilize the investigation agent, Amazon GuardDuty must be enabled for the AWS organization. Three new permissions are required to create, retrieve, and list investigations for a detector. Administrator accounts can create, retrieve, and view investigations for both their own and member accounts. Member accounts are restricted to retrieving and viewing investigations for their own account only; they cannot create investigations or access those belonging to other accounts. An account ID is necessary only when investigating a specific member account; investigations covering the administrator account or the entire organization do not require one.
Investigations can be initiated from the GuardDuty console, targeting a specific finding, an AWS account, or an entire organization. Upon completion, investigations provide a summary, mappings to MITRE ATT&CK techniques, identification of affected AWS resources, risk and confidence assessments, and recommended remediation steps. The feature is also accessible via the AWS CLI and SDK through the `CreateInvestigation`, `GetInvestigation`, and `ListInvestigations` APIs. As investigations are asynchronous, users create an investigation and then retrieve the results once processing is complete. The CLI also supports natural-language prompts for initiating investigations.
AWS has designed the investigation agent with an API-first approach, enabling organizations to integrate automated investigations into existing security workflows. This allows for the enrichment of GuardDuty findings with correlated evidence, threat assessments, and recommended actions. The investigation agent also integrates with Amazon EventBridge, facilitating the transmission of enriched GuardDuty findings—including risk scores, confidence assessments, MITRE ATT&CK mappings, and recommended actions—to SIEM platforms, ticketing systems, and automation tools.
AWS clarified that the investigation agent is specifically tailored for GuardDuty findings and operates independently of AWS Security Agent and AWS DevOps Agent.
The investigation agent leverages AWS's cross-Region inference capability to analyze findings and generate structured assessments. While data remains encrypted in transit, inference requests may be processed in another AWS Region within the same geographic area. Each investigation yields a risk level, confidence score, summary, detailed investigation information, and recommended actions. The agent analyzes findings only from accounts the user is authorized to access, with results tailored to the selected investigation scope.
Additionally, the investigation agent supports integration with AI assistants through the Model Context Protocol (MCP), an open standard for securely connecting AI assistants to external data sources and tools. Via the official AWS MCP server, organizations can incorporate GuardDuty investigations into AI-powered workflows using MCP-compatible clients such as Kiro and Anthropic's Claude.
