AWS announces the preview of AI-powered investigations in Amazon GuardDuty, a new capability that automatically analyzes GuardDuty findings and accounts to help you quickly distinguish true threats from benign findings. This feature addresses the time-intensive manual investigation process that contributes to alert fatigue and slows incident response for security operations centers and cloud security analysts.
AI-powered investigations examine finding context, related activity from the last 90 days, affected resources, and threat indicators using knowledge graphs and threat intelligence, in minutes. Each investigation provides a disposition assessment with confidence scoring, MITRE ATT&CK® technique classification, supporting evidence, and actionable recommendations for suppression, containment, or remediation. This automation enables security teams to focus on genuine threats across individual AWS accounts or entire AWS Organizations and accelerate mean time to resolution.
This feature is available in preview in 10 AWS Regions: US East (N. Virginia), US East (Ohio), US West (Oregon), Canada (Central), Europe (Ireland), Europe (London), Europe (Frankfurt), Europe (Paris), Europe (Stockholm), Asia Pacific (Tokyo). To get started, access AI-powered investigations through the Amazon GuardDuty console, CLI, API, or AWS’ MCP Server.
To learn more, visit the Amazon GuardDuty User Guide.
Categories: general:products/amazon-guardduty
Source: Amazon Web Services
Latest Posts
- AWS End User Messaging and Amazon SES now offer AI agent skills for the AWS MCP Server
- Amazon EC2 M8i and M8i-flex instances are now available in additional regions
- Amazon EC2 R8i and R8i-flex instances are now available in additional regions
- Amazon EC2 C8i and C8i-flex instances are now available in additional regions
