AWS GuardDuty Investigation Agent Public Preview Automates Threat Triage for Security Teams

AWS has released the public preview of the Amazon GuardDuty investigation agent, an AI-powered security tool that automates the triage of security findings. The tool correlates finding metadata, 90-day activity logs, and resource topologies into structured analysis reports with risk ratings, confidence scores, and MITRE ATT&CK classification. It is also reachable through the AWS MCP Server, allowing security teams to trigger investigations directly from agentic tooling such as Claude Desktop.

The announcement builds on the growing challenge of alert fatigue in security operations. AWS’s Clarke Rodgers, from the Office of the CISO, framed the problem succinctly: “Security teams don’t have a detection problem. They have an investigation problem.”

How the investigation agent works

The agent evaluates telemetry on demand across three scopes: individual findings, resource-level context, and account-wide or organization-wide patterns. After analysis, it returns a structured result set containing an overall risk rating (Info to Critical), a confidence score, MITRE ATT&CK classification, and actionable CLI remediation steps.

AWS Security Hero Sena Yakut distinguished the agent from GuardDuty’s existing Extended Threat Detection: “Extended Threat Detection connects related findings into an attack sequence, while Investigation analyzes the affected resources, IAM activity, and surrounding context to generate a summary with recommended next steps.” She noted the strongest fit for organizations without a large security function, where initial evidence-gathering consumes a disproportionate share of analyst time. Yakut tested the agent against sample findings and obtained low risk ratings on test resources, as expected. She cautioned: “AI should assist the investigation, not replace it. Human validation and decision-making are still essential before taking any remediation actions.”

MCP integration and agentic workflows

The most notable detail for teams already running agentic tooling is the integration with the AWS MCP Server. Developers and SecOps engineers can trigger an investigation from Claude Desktop or a custom CLI agent runner using existing AWS IAM credentials. This places security investigation inside the same agent surface as code and infrastructure work.

A typical CLI invocation looks like:

aws guardduty create-investigation \
–region us-east-1 \
–detector-id 12abc34d567e8fa901bc2d34eexample \
–trigger-prompt “Investigate finding 1ab2c3d4e5f6a7b8c9d0e1f2a3b4c5d6. Note: IP belongs to an internal VPN gateway.”

Investigations can also be triggered programmatically via the AWS SDK or via EventBridge rules to automate downstream response pipelines. However, the preview quotas introduce a significant constraint: 10 investigations per account per day, capped at 100 cumulative per account during the preview. That budget is more suited for manual triage than automated response pipelines. Teams can prototype the wiring but cannot yet run the agent at alert volume.

Comparison with other hyperscaler offerings

The launch places GuardDuty in a category that Microsoft and Google entered earlier. Microsoft has shipped Security Copilot since 2024 for incident summarization and guided response across Defender and Sentinel. Google offers Gemini-assisted investigation inside Security Operations. What distinguishes the GuardDuty agent is its bounded scope: it operates only on GuardDuty’s own finding corpus and surrounding AWS telemetry, rather than serving as a general security assistant. This narrows what it can reason about but makes its outputs easier to validate against a known data set.

To address data residency and compliance concerns, AWS leverages its Cross-Region Inference Service (CRIS) powered by Bedrock models. While compute inference may route to another region within the same geographic boundary, investigation data and generated reports remain stored within the originating home region, according to AWS.

Preview restrictions and practical considerations

The investigation agent is currently available in 10 commercial AWS regions: US East (N. Virginia, Ohio), US West (Oregon), Canada (Central), Europe (Frankfurt, Ireland, London, Paris, Stockholm), and Asia Pacific (Tokyo). Usage is free during the preview period, subject to the throttle limit of 10 investigations per account per day, capped at 100 cumulative per account. Failed investigations do not count toward either quota.

For teams evaluating the agent, the preview is best used for manual testing of output quality and workflow integration. The quotas preclude running it at scale, and the human-in-the-loop requirement remains essential. AWS’s own Loom reference platform, released the same month, addresses the governance questions that arise when agentic workflows handle security telemetry, including which principal ran the investigation, how the context window is retained, and how transcripts are managed.

Source: InfoQ article “AWS Launches Amazon GuardDuty Investigation Agent to Automate Threat Triage” by Steef-Jan Wiggers, July 28, 2026. https://www.infoq.com/news/2026/07/guardduty-investigation-agent/