Introducing the Amazon GuardDuty investigation agent: on-demand AI-powered threat assessment

Amazon GuardDuty's investigation agent (public preview) automates the analysis of GuardDuty findings by correlating evidence across accounts and services and producing structured assessments that include risk level, confidence, MITRE ATT&CK technique mappings, resource mapping, and prioritized remediation actions. The post explains how to enable and use the agent via the AWS Console, CLI, APIs, and the AWS MCP server, details required IAM permissions and the authorization model, describes cross-Region inference and expected investigation timings, provides example workflows for integrating with SIEMs and automation, and notes preview availability and quota limits.