AWS wants GuardDuty to automate the first steps of threat investigations
Amazon GuardDuty investigation agent is now in public preview. The feature provides AI-powered investigations of GuardDuty findings, AWS accounts and AWS organizations, helping security teams reduce investigation time.
During the public preview, the investigation agent is available at no additional cost in 10 AWS Regions. Usage is limited to 10 investigations per account per day, with a cumulative limit of 100 investigations per account during the preview period. Failed investigations do not count toward these quotas.
Amazon GuardDuty is a managed threat detection service that continuously monitors AWS accounts, workloads and data for malicious activity, delivering security findings for investigation and remediation.
“Whether you’re investigating a single suspicious finding or assessing the security posture of your entire organization, the investigation agent provides structured assessments with risk levels, confidence scores and actionable recommendations,” Allan Holmes, Senior Specialist TAM – Security at AWS, said.
Enabling and using the investigation agent
To use the investigation agent, Amazon GuardDuty must be enabled for the AWS organization. Three new permissions are required to create investigations, retrieve results and list investigations for a detector.
Administrator accounts can create investigations, retrieve results and view investigations for their own and member accounts. Member accounts can retrieve and view investigations for their own account only. They cannot create investigations or access investigations belonging to other accounts.
An account ID is required only when investigating a specific member account. Investigations covering the administrator account or the entire organization do not require one.
GuardDuty investigation setup (Source: AWS)
Investigations can be started from the GuardDuty console for a specific finding, an AWS account or an entire organization. Completed investigations include a summary, MITRE ATT&CK technique mappings, affected AWS resources, risk and confidence assessments, and recommended remediation steps.
The feature is also available through the AWS CLI and SDK using the CreateInvestigation, GetInvestigation and ListInvestigations APIs. Because investigations are asynchronous, users create an investigation and retrieve the results after processing completes. The CLI also supports natural-language prompts to investigate a specific finding, an AWS account or an entire organization.
AWS said the API-first design enables organizations to integrate automated investigations into existing security workflows, enriching GuardDuty findings with correlated evidence, threat assessments and recommended actions.
The investigation agent also integrates with Amazon EventBridge, allowing organizations to send enriched GuardDuty findings, including risk scores, confidence assessments, MITRE ATT&CK mappings and recommended actions, to SIEM platforms, ticketing systems and automation tools. AWS said the investigation agent is designed specifically for GuardDuty findings and is separate from AWS Security Agent and AWS DevOps Agent.
Integrating with AI assistants through MCP
The Model Context Protocol (MCP) is an open standard that lets AI assistants securely connect to external data sources and tools. Through the official AWS MCP server, organizations can integrate GuardDuty investigations into AI-powered workflows using MCP-compatible clients such as Kiro and Anthropic’s Claude.
How investigations work
When an investigation starts, the GuardDuty investigation agent uses AWS’s cross-Region inference capability to analyze findings and generate a structured assessment. Inference requests may be processed in another AWS Region within the same geographic area while data remains encrypted in transit.
Each investigation returns a risk level, confidence score, summary, investigation details and recommended actions. Investigations can target a specific finding, a member account or an entire organization. The investigation agent analyzes findings only from accounts the user is authorized to access and returns results based on the selected investigation scope.