AWS Security Incident Response now provides agentic AI-powered investigation

AWS Security Incident Response Updates

AWS Security Incident Response now offers agentic AI-powered investigation capabilities to expedite preparation, response, and recovery from security events. The investigative agent automatically gathers and correlates evidence from multiple AWS data sources, presenting findings in clear, actionable summaries to minimize business disruption.

When a security event case is created, the investigative agent assesses case details, identifies missing information, and asks clarifying questions to gather necessary details. It collects relevant information from sources like AWS CloudTrail, IAM, Amazon EC2, and AWS Cost Explorer, providing a comprehensive analysis that reduces manual evidence gathering and speeds up investigations. Security teams can track activities and view summaries through the AWS console and preferred integration tools.

This feature is automatically enabled for all Security Incident Response customers at no additional cost in all AWS Regions where the service is available.

What to do

• Visit the Security Incident Response overview page to learn more.
• Access the Security Incident Response console to get started.

Source: AWS release notes

If you need further guidance on AWS, our experts are available at AWS@westloop.io. You may also reach us by submitting the Contact Us form.