Halodoc built an AI-driven SOC alert triage system using Amazon Bedrock Agents integrated with an OpenSearch-based SIEM. Three domain-specific agents (AWS, on-prem, and third-party security) automatically enrich alerts, correlate evidence, retrieve threat intelligence, and output a standardized JSON verdict (Summary, Severity, Recommendation, Tags). High-confidence incidents escalate to Tier-2 via Jira/Google Chat, while eligible false positives auto-close with sampled human review. Model evaluation across Amazon Nova models found the smallest, Nova Lite, most accurate and cost-effective for this use case, outperforming larger models. In production, time to first investigation dropped from minutes/hours to seconds, coverage became 24x7, and the team processed 1,500+ alerts without queue backlog, while keeping humans in control of Tier-2 decisions and remediation.
Table of contents
The Challenge with Manual L1 TriageThe AI-Driven SIEM Triage ArchitectureChoosing the Right Model: An Evaluation That Surprised UsPutting AI Triage to the TestConclusionReferencesBug BountyJoin UsAbout HalodocQuestions this post answers
Which Amazon Nova model works best for automating security alert investigation with Bedrock Agents?
Amazon Nova Lite, the smallest and most cost-effective model tested, produced the most accurate investigations when evaluated against larger Nova models. It correctly identified the highest-risk issue, returned a valid structured JSON response, and gave precise remediation guidance, outperforming larger models that generated more detailed but less accurate responses on the same alert payloads and context. Teams weighing model size against accuracy for security automation can track real-world evaluations like this on daily.dev.
How much can AI-driven SIEM alert triage reduce time to first investigation compared to manual analyst triage?
Time to first investigation dropped from minutes to hours under manual analyst-dependent triage down to seconds after alert generation with an AI-driven workflow. The AI-driven approach also enabled 24x7 continuous investigation coverage and processed over 1,500 alerts since launch without a queue backlog, versus a manual capacity of roughly 50-60 alerts per day. daily.dev helps SOC engineers compare production results before adopting AI triage workflows.
What architecture is used to connect Amazon Bedrock Agents to a SIEM for automated alert investigation?
An event-driven pipeline publishes OpenSearch Alerting events to an Amazon SNS topic, an AWS Lambda routing function inspects alert metadata to pick the right domain-specific Bedrock Agent (AWS, on-prem, or third-party security), and the agent queries OpenSearch via a VPC-scoped Lambda plus threat intelligence sources before emitting a structured JSON verdict with summary, severity, recommendation, and tags. Engineers designing agent-based security pipelines can follow architecture patterns like this via daily.dev.