--- title: Automating SOC Alert Triage with Amazon Bedrock Agents description: Halodoc built an AI-driven SOC alert triage system using Amazon Bedrock Agents integrated with an OpenSearch-based SIEM. Three domain-specific agents (AWS,... canonical: https://daily.dev/posts/automating-soc-alert-triage-with-amazon-bedrock-agents-kuxzq7qe9 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Automating SOC Alert Triage with Amazon Bedrock Agents | daily.dev og:description: Halodoc built an AI-driven SOC alert triage system using Amazon Bedrock Agents integrated with an OpenSearch-based SIEM. Three domain-specific agents (AWS,... og:url: https://daily.dev/posts/automating-soc-alert-triage-with-amazon-bedrock-agents-kuxzq7qe9 og:image: https://api.daily.dev/og/posts/KuXzQ7qE9.png og:image:alt: Automating SOC Alert Triage with Amazon Bedrock Agents og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Automating SOC Alert Triage with Amazon Bedrock Agents **[Halodoc](https://daily.dev/sources/halodoc)** · 16 min read · 1 upvotes · 0 comments ## Summary Halodoc built an AI-driven SOC alert triage system using Amazon Bedrock Agents integrated with an OpenSearch-based SIEM. Three domain-specific agents (AWS, on-prem, and third-party security) automatically enrich alerts, correlate evidence, retrieve threat intelligence, and output a standardized JSON verdict (Summary, Severity, Recommendation, Tags). High-confidence incidents escalate to Tier-2 via Jira/Google Chat, while eligible false positives auto-close with sampled human review. Model evaluation across Amazon Nova models found the smallest, Nova Lite, most accurate and cost-effective for this use case, outperforming larger models. In production, time to first investigation dropped from minutes/hours to seconds, coverage became 24x7, and the team processed 1,500+ alerts without queue backlog, while keeping humans in control of Tier-2 decisions and remediation. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why did a smaller Amazon Nova model outperform larger models for SOC alert triage? Amazon Nova Lite, the smallest and most cost-effective model evaluated, correctly identified the highest-risk security issue, returned valid structured JSON, and gave precise remediation guidance, while larger models produced detailed but less accurate responses. The evaluation used identical Security Hub alert payloads, log context, and prompts across models, showing that for security investigations, accuracy and structured output mattered more than model size. _Weighing model size against accuracy for security automation is easier when developers compare real evaluation writeups on daily.dev._ ### How much can AI-driven SIEM alert triage improve SOC response times compared to manual investigation? Time to first investigation dropped from minutes or hours under manual Tier-1 triage to seconds after alert generation, with 24x7 continuous coverage instead of analyst-dependent windows. Manual daily triage capacity was limited to 50-60 alerts per analyst, whereas the automated workflow investigated the full daily alert inflow without queue backlog, processing over 1,500 alerts since launch. _Teams weighing AI automation for SOC operations can track real deployment metrics like these on daily.dev._ ### What guardrails prevent an AI SOC triage agent from taking unsafe actions on security alerts? Bedrock Agents operate with read-only permissions and cannot modify infrastructure, change configurations, access credentials, or execute remediation workflows. Agent instructions are isolated from alert content so attacker-controlled log fields cannot manipulate agent behavior, and all Tier-2 investigations, containment, and remediation remain fully human, with auto-closed false positives periodically sampled for analyst validation. _Engineers designing safe AI agent permissions for security workflows can follow architectural patterns like this on daily.dev._ ## Similar posts on daily.dev - [Alert triage in under 3 minutes with Elastic's agentic SOC — Elastic Security Labs](https://daily.dev/posts/alert-triage-in-under-3-minutes-with-elastic-s-agentic-soc-elastic-security-labs-tnairkmjv) · Elastic Security Labs · 2 upvotes · 0 comments - [Automate model quota request and operational issue triage on Amazon Bedrock](https://daily.dev/posts/automate-model-quota-request-and-operational-issue-triage-on-amazon-bedrock-objak9jkv) · AWS · 0 upvotes · 0 comments - [Building an Agentic SOC on a Stream](https://daily.dev/posts/building-an-agentic-soc-on-a-stream-cnmrukzap) · Confluent Blog · 0 upvotes · 0 comments - [Agentic SOC alert triage: 60% to 92% AI accuracy — Elastic Security Labs](https://daily.dev/posts/agentic-soc-alert-triage-60-to-92-ai-accuracy-elastic-security-labs-dxwh13gmo) · Elastic Security Labs · 1 upvotes · 0 comments - [How Harmonic Security improved their data-leakage detection system with low-latency fine-tuned models using Amazon SageMaker, Amazon Bedrock, and Amazon Nova Pro](https://daily.dev/posts/how-harmonic-security-improved-their-data-leakage-detection-system-with-low-latency-fine-tuned-model-doxfymu2i) · AWS · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#amazon-bedrock](https://daily.dev/tags/amazon-bedrock) [View this post on daily.dev](https://daily.dev/posts/automating-soc-alert-triage-with-amazon-bedrock-agents-kuxzq7qe9) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Automating SOC Alert Triage with Amazon Bedrock Agents","url":"https://daily.dev/posts/automating-soc-alert-triage-with-amazon-bedrock-agents-kuxzq7qe9","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/automating-soc-alert-triage-with-amazon-bedrock-agents-kuxzq7qe9"},"datePublished":"2026-08-14T05:59:37.796Z","dateModified":"2026-09-14T06:29:49.017Z","description":"Halodoc built an AI-driven SOC alert triage system using Amazon Bedrock Agents integrated with an OpenSearch-based SIEM. Three domain-specific agents (AWS,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c84b63e436e94ef0958f499ffad16fed?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c84b63e436e94ef0958f499ffad16fed?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Halodoc","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Halodoc","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/b3d554a1a7b44df48789c7ca6e50c4c2","url":"https://daily.dev/sources/halodoc"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/automating-soc-alert-triage-with-amazon-bedrock-agents-kuxzq7qe9","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,amazon-bedrock","timeRequired":"PT16M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Halodoc","item":"https://daily.dev/sources/halodoc"},{"@type":"ListItem","position":3,"name":"Automating SOC Alert Triage with Amazon Bedrock Agents"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/automating-soc-alert-triage-with-amazon-bedrock-agents-kuxzq7qe9#faq","mainEntity":[{"@type":"Question","name":"Why did a smaller Amazon Nova model outperform larger models for SOC alert triage?","acceptedAnswer":{"@type":"Answer","text":"Amazon Nova Lite, the smallest and most cost-effective model evaluated, correctly identified the highest-risk security issue, returned valid structured JSON, and gave precise remediation guidance, while larger models produced detailed but less accurate responses. The evaluation used identical Security Hub alert payloads, log context, and prompts across models, showing that for security investigations, accuracy and structured output mattered more than model size. Weighing model size against accuracy for security automation is easier when developers compare real evaluation writeups on daily.dev."}},{"@type":"Question","name":"How much can AI-driven SIEM alert triage improve SOC response times compared to manual investigation?","acceptedAnswer":{"@type":"Answer","text":"Time to first investigation dropped from minutes or hours under manual Tier-1 triage to seconds after alert generation, with 24x7 continuous coverage instead of analyst-dependent windows. Manual daily triage capacity was limited to 50-60 alerts per analyst, whereas the automated workflow investigated the full daily alert inflow without queue backlog, processing over 1,500 alerts since launch. Teams weighing AI automation for SOC operations can track real deployment metrics like these on daily.dev."}},{"@type":"Question","name":"What guardrails prevent an AI SOC triage agent from taking unsafe actions on security alerts?","acceptedAnswer":{"@type":"Answer","text":"Bedrock Agents operate with read-only permissions and cannot modify infrastructure, change configurations, access credentials, or execute remediation workflows. Agent instructions are isolated from alert content so attacker-controlled log fields cannot manipulate agent behavior, and all Tier-2 investigations, containment, and remediation remain fully human, with auto-closed false positives periodically sampled for analyst validation. Engineers designing safe AI agent permissions for security workflows can follow architectural patterns like this on daily.dev."}}]} ```