Amazon GuardDuty Investigation Agent Streamlines Threat Assessments
Amazon has introduced the GuardDuty investigation agent, now in public preview, aimed at improving security investigations within Amazon Web Services (AWS) environments. This new tool is designed to cut down investigation times from hours to mere minutes by automating the correlation of security findings. GuardDuty, Amazon's managed threat detection service, continuously monitors AWS accounts and workloads for suspicious activity, providing detailed security findings for better visibility and remediation.
The investigation agent is particularly useful for security teams that often spend significant time correlating data across various tools. By automating this process, the agent delivers actionable intelligence directly integrated into GuardDuty, accessible on demand through the AWS Management Console, AWS Command Line Interface (AWS CLI), AWS APIs, or AWS SDKs. Each investigation conducted by the agent returns a risk level, confidence assessment, MITRE ATT&CK technique mapping, resource mapping, and prioritized recommendations.
Users can scope investigations from the console for specific findings, accounts, or across all accounts within their organization. The AWS CLI and API also allow for free-form trigger prompts, enabling users to describe their investigation needs in natural language, guiding the agent's analysis based on specific concerns or priorities.
The investigation agent operates without requiring direct management, as it processes findings and delivers assessments automatically. It utilizes the Cross-Region Inference Service (CRIS) to determine the optimal AWS Region for processing, ensuring that data remains secure and compliant with regional storage requirements. Each completed investigation provides insights including risk levels, confidence scores, and detailed recommendations for remediation.
To utilize the investigation agent, users must ensure they have the necessary permissions set up in their AWS accounts. Administrator accounts can create and manage investigations, while member accounts have limited access to their own investigation results. The agent is designed to fit seamlessly into existing security workflows, allowing for integration with third-party tools and automation platforms.
During the public preview, which spans ten AWS regions, users can conduct up to ten investigations per account each day, with a total limit of 100 investigations during this period. The GuardDuty investigation agent is positioned to enhance the efficiency of security teams by allowing them to focus on confirmed security events rather than manual data correlation. This tool represents a significant advancement in AWS's commitment to providing robust security solutions for its users, enabling faster and more effective threat assessments.
