--- title: AWS Launches Amazon GuardDuty Investigation Agent to... description: AWS has launched a public preview of the Amazon GuardDuty Investigation Agent, an AI-powered tool that automates security threat triage by correlating... canonical: https://daily.dev/posts/aws-launches-amazon-guardduty-investigation-agent-to-automate-threat-triage-r0z3ja3bw twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: AWS Launches Amazon GuardDuty Investigation Agent to Automate Threat Triage | daily.dev og:description: AWS has launched a public preview of the Amazon GuardDuty Investigation Agent, an AI-powered tool that automates security threat triage by correlating... og:url: https://daily.dev/posts/aws-launches-amazon-guardduty-investigation-agent-to-automate-threat-triage-r0z3ja3bw og:image: https://api.daily.dev/og/posts/R0Z3ja3bw.png og:image:alt: AWS Launches Amazon GuardDuty Investigation Agent to Automate Threat Triage og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # AWS Launches Amazon GuardDuty Investigation Agent to Automate Threat Triage **[InfoQ](https://daily.dev/sources/infoq)** · 5 min read · 0 upvotes · 0 comments ## Summary AWS has launched a public preview of the Amazon GuardDuty Investigation Agent, an AI-powered tool that automates security threat triage by correlating GuardDuty findings, 90-day activity logs, and resource topologies into structured reports. Each report includes a risk rating (Info to Critical), confidence score, MITRE ATT&CK classification, and CLI remediation steps. The agent supports three analysis scopes: individual findings, single AWS accounts, and up to 100 accounts in an AWS Organization. It integrates with AWS SDKs, CLI, EventBridge, and the AWS MCP Server, enabling investigations from agentic tooling like Claude Desktop. Data residency is handled via AWS Bedrock's Cross-Region Inference Service, keeping reports in the originating region. Preview usage is free but capped at 10 investigations per account per day (100 total during preview), making it suitable for analyst evaluation rather than fully automated pipelines. Experts caution that AI should assist, not replace, human validation before taking remediation actions. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Introducing Amazon GuardDuty AI Protection for AWS AI workloads](https://daily.dev/posts/introducing-amazon-guardduty-ai-protection-for-aws-ai-workloads-gyi6jo972) · AWS · 1 upvotes · 0 comments - [AWS Announces General Availability of DevOps Agent for Automated Incident Investigation](https://daily.dev/posts/aws-announces-general-availability-of-devops-agent-for-automated-incident-investigation-o3foudjfb) · InfoQ · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#aws](https://daily.dev/tags/aws), [#ai-agents](https://daily.dev/tags/ai-agents) [View this post on daily.dev](https://daily.dev/posts/aws-launches-amazon-guardduty-investigation-agent-to-automate-threat-triage-r0z3ja3bw) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"AWS Launches Amazon GuardDuty Investigation Agent to Automate Threat Triage","url":"https://daily.dev/posts/aws-launches-amazon-guardduty-investigation-agent-to-automate-threat-triage-r0z3ja3bw","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/aws-launches-amazon-guardduty-investigation-agent-to-automate-threat-triage-r0z3ja3bw"},"datePublished":"2026-07-28T07:21:05.958Z","dateModified":"2026-07-28T07:21:28.270Z","description":"AWS has launched a public preview of the Amazon GuardDuty Investigation Agent, an AI-powered tool that automates security threat triage by correlating...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1697c5118a3773037ae9b5fd7edc5871?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1697c5118a3773037ae9b5fd7edc5871?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoQ","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoQ","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/afc3bced3e1e4b188dd9127017a60e0c","url":"https://daily.dev/sources/infoq"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/aws-launches-amazon-guardduty-investigation-agent-to-automate-threat-triage-r0z3ja3bw","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,aws,ai-agents","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoQ","item":"https://daily.dev/sources/infoq"},{"@type":"ListItem","position":3,"name":"AWS Launches Amazon GuardDuty Investigation Agent to Automate Threat Triage"}]} ```