New featureMedium

Amazon GuardDuty AI-powered investigations accelerate threat response (Preview)

Amazon GuardDuty introduces AI-powered investigations in preview, helping security teams focus on genuine threats

AWS announces the preview of AI-powered investigations in Amazon GuardDuty. This new capability automatically analyzes GuardDuty findings and accounts to help quickly distinguish true threats from benign findings. The feature examines finding context, related activity from the last 90 days, affected resources, and threat indicators using knowledge graphs and threat intelligence within minutes. Each investigation provides a disposition assessment with confidence scoring, MITRE ATT&CK® technique classification, supporting evidence, and actionable recommendations for suppression, containment, or remediation. This automation enables security teams to focus on genuine threats across individual AWS accounts or entire AWS Organizations and accelerate mean time to resolution. The feature is available in preview in 10 AWS Regions: US East (N. Virginia), US East (Ohio), US West (Oregon), Canada (Central), Europe (Ireland), Europe (London), Europe (Frankfurt), Europe (Paris), Europe (Stockholm), Asia Pacific (Tokyo). To get started, access AI-powered investigations through the Amazon GuardDuty console, CLI, API, or AWS' MCP Server.

Read the original AWS announcement

Related articles and terms

Threat Detection with Amazon GuardDuty - ML-Based Anomaly Detection and Incident ResponseLearn how GuardDuty detects threats, classifies findings, and integrates with Security Hub for incident response.Amazon GuardDutyA managed threat detection service that uses machine learning and threat intelligence to continuously monitor and detect threats across AWS accounts and workloadsAmazon DetectiveA service that automatically collects and analyzes VPC Flow Logs, CloudTrail, and GuardDuty findings to streamline root cause investigation of security incidentsVulnerability Assessment and Threat Detection - Continuous Security Monitoring with Amazon Inspector and GuardDutyLearn how to design and operate vulnerability assessment and threat detection using Amazon Inspector and Amazon GuardDuty.Investigating Security Incidents with Amazon Detective - Root Cause Identification Through Graph AnalysisLearn about investigating GuardDuty findings with Detective, entity profiles, and leveraging behavior graphs.