Building a Multi-Agent AI Cybersecurity Investigation Agent on AWS with Strands Agents SDK and Amazon Bedrock

19:34Claude responded: A seven-agent cybersecurity investigation pipeline on AWS that automates IOC enrichment with MITRE ATT&CK mapping, CloudTrail forensics, blast radius assessmen…A seven-agent cybersecurity investigation pipeline on AWS that automates IOC enrichment with MITRE ATT&CK mapping, CloudTrail forensics, blast radius assessment, non-destructive containment with evidence preservation, and NIST SP 800-61 compliant reporting with automatic GDPR/HIPAA regulatory filing.

sweta jha

Published Jun 26, 2026

Last modified Jun 26, 2026

Building a Multi-Agent AI Cybersecurity Investigation Agent on AWS with Strands Agents SDK and Amazon Bedrock

GitHub: https://github.com/its-me-sweta/CyberSecurity_Investigation_Assistant.git

Introduction

Security Operations Centres (SOCs) are drowning in alerts. The average enterprise generates thousands of security findings per day — from GuardDuty, Security Hub, CloudTrail anomalies, WAF blocks, and Macie data findings — yet most organisations lack the analyst capacity to investigate each one thoroughly and quickly.

In this post I'll walk through a production-ready, seven-agent AI pipeline that automates the full cybersecurity incident investigation lifecycle — from the moment an alert fires to the regulatory notification, forensic archive, and executive report — using:

Strands Agents SDK with @tool decorators
Amazon Bedrock Nova Pro for AI-driven threat analysis and report generation
Amazon GuardDuty, Security Hub, CloudTrail, VPC Flow Logs, Macie as alert sources
Amazon CloudWatch Logs Insights for forensic log analysis
AWS Systems Manager for automated containment and patching
Amazon EC2, IAM, S3, Secrets Manager for automated containment actions
Amazon DynamoDB for investigation state and NIST SP 800-61 audit trail
Amazon S3 with Object Lock for forensic evidence preservation (7-year retention)
Amazon SES + SNS for CISO notifications and stakeholder briefings
AgentCore Runtime for serverless deployment

Architecture Overview

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
                   ┌──────────────────────────────────────────────┐
                   │ Alert Sources: GuardDuty · SecurityHub        │
                   │ CloudTrail · VPC Flow Logs · WAF · Macie      │
                   └────────────────────┬─────────────────────────┘
                                        │ EventBridge → Lambda → API
                   ┌────────────────────▼─────────────────────────┐
                   │           Orchestrator Agent                  │
                   │  NIST IR Severity · P1 Bridge · Audit Trail   │
                   └──────┬──────────────────────────────────┬────┘
                           │                                  │
         ┌─────────────────▼──────┐          ┌───────────────▼──────────────┐
         │  Threat Intelligence   │          │   Forensic Analysis Agent    │
         │  Agent                 │          │   CloudTrail · VPC Flow Logs  │
         │  IOC Enrichment        │          │   IAM Inspection · Timeline   │
         │  MITRE ATT&CK Mapping  │          │   Process Artifacts · RCA     │
         └─────────────────┬──────┘          └───────────────┬──────────────┘
                           └──────────────┬──────────────────┘
                                          │
                   ┌───────────────────────▼──────────────────────┐
                   │           Blast Radius Agent                  │
                   │  Resource Enumeration · Data Exposure          │
                   │  Lateral Movement Paths · Regulatory Triggers  │
                   └───────────────────────┬──────────────────────┘
                                           │
                   ┌───────────────────────▼──────────────────────┐
                   │           Containment Agent                   │
                   │  EC2 Isolation · IAM Revocation · NACL Block  │
                   │  S3 Quarantine · Secret Rotation · Snapshot   │
                   └───────────────────────┬──────────────────────┘
                                           │
                   ┌───────────────────────▼──────────────────────┐
                   │           Remediation Agent                   │
                   │  Remove Persistence · Patch CVEs · Restore    │
                   │  Security Hub Findings · Update Controls      │
                   └───────────────────────┬──────────────────────┘
                                           │
                   ┌───────────────────────▼──────────────────────┐
                   │           Reporting Agent                     │
                   │  Executive Summary · Technical Report         │
                   │  Regulatory Filing (GDPR/HIPAA/PCI DSS)       │
                   │  Jira Ticket · Archive (Object Lock 7yr)      │
                   └──────────────────────────────────────────────┘

NIST IR Severity Framework

1
2
3
4
5
6
SEVERITY_MAP = {
    "CRITICAL": {"response_min": 15,  "ir_team": True,  "ciso_notify": True},
    "HIGH":     {"response_min": 60,  "ir_team": True,  "ciso_notify": False},
    "MEDIUM":   {"response_min": 240, "ir_team": False, "ciso_notify": False},
    "LOW":      {"response_min": 480, "ir_team": False, "ciso_notify": False},
}

CRITICAL triggers immediate CISO notification, IR bridge call, and P1 war room. The severity is also auto-elevated based on MITRE ATT&CK category:

1
2
3
4
5
MITRE_CATEGORY_SEVERITY = {
    "exfiltration": "CRITICAL",  "impact": "CRITICAL",
    "lateral-movement": "HIGH",   "privilege-escalation": "HIGH",
    "credential-access": "HIGH",  "persistence": "HIGH",
}

Stage 1 — Threat Intelligence Agent

The Threat Intel Agent enriches every IOC across multiple feeds:

IP Reputation (VirusTotal + AbuseIPDB via Lambda proxy, with 1-hour DynamoDB cache):

1
2
3
4
@tool
def enrich_ip_reputation(ip_address: str) -> dict:
    # Check local cache → Lambda proxy → VirusTotal/AbuseIPDB
    # Returns: threat_score (0-100), categories, ASN, geo, known_malicious

MITRE ATT&CK Mapping — automatically maps CloudTrail API calls to techniques:

1
2
3
4
5
6
7
MITRE_TTP_MAP = {
    "GetSecretValue":   ("T1552", "Credential Access", "Credentials from Password Stores"),
    "CreateUser":       ("T1136", "Persistence",       "Create Account"),
    "AttachUserPolicy": ("T1098", "Privilege Escalation", "Account Manipulation"),
    "StopLogging":      ("T1562", "Defense Evasion",   "Impair Defenses"),
    "PutBucketPolicy":  ("T1537", "Exfiltration",      "Transfer Data to Cloud Account"),
}

Kill Chain Stage determined automatically:

POST_EXPLOITATION: Exfiltration or Impact techniques detected
EXPLOITATION: Lateral Movement or Collection
ESTABLISHMENT: Persistence or Privilege Escalation
RECONNAISSANCE: Discovery techniques only

Stage 2 — Forensic Analysis Agent

The Forensics Agent performs deep analysis across four data sources:

CloudTrail (72h lookback):

1
2
3
4
5
6
7
@tool
def analyse_cloudtrail_events(principal_arn, start_time, end_time) -> dict:
    r = cloudtrail.lookup_events(
        LookupAttributes=[{"AttributeKey": "Username", "AttributeValue": entity}],
        StartTime=start, EndTime=end, MaxResults=50,
    )
    # Flags: suspicious API calls, out-of-hours activity, geographic anomalies

VPC Flow Logs (CloudWatch Logs Insights):

1
2
3
4
query = """fields srcAddr, dstAddr, dstPort, bytes, action
           | filter action = "ACCEPT" and bytes > 100000
           | sort bytes desc | limit 20"""
# Flags transfers > 10MB as potential exfiltration

IAM Inspection — detects privilege escalation via policy analysis:

1
has_admin = any("Admin" in p or "FullAccess" in p for p in attached_policies)

Attack Timeline Reconstruction — creates a chronological kill chain from all events, identifying the kill chain stage and whether data was exfiltrated.

All forensic artifacts are stored in S3 with KMS encryption and Object Lock (COMPLIANCE mode) for evidence chain-of-custody.

Stage 3 — Blast Radius Agent

Maps the full impact scope of the incident:

Resource Enumeration — all EC2, RDS, Lambda, S3, IAM entities reachable from the compromised principal.

Data Exposure Assessment:

1
2
3
4
5
if "GetObject" in api_calls or "ListBuckets" in api_calls:
    data_types.append("S3_OBJECTS")
    regulatory_triggers.append("GDPR_ASSESSMENT_REQUIRED")
if "GetSecretValue" in api_calls:
    data_types.append("SECRETS_MANAGER")

Regulatory Triggers:

Trigger	Regulation	Deadline
PII exposed > 500 records	GDPR	72 hours
PHI data involved	HIPAA	60 days
PCI card data exposed	PCI DSS	24 hours

Stage 4 — Containment Agent

Seven automated containment actions — all non-destructive (preserve forensic evidence):

1
2
3
4
5
6
7
8
9
# SAFETY RULE: NEVER terminate EC2 (preserves forensics)
# NEVER delete IAM users (preserves audit trail)
# NEVER remove S3 objects (preserves evidence)

@tool
def isolate_ec2_instance(instance_id, investigation_id) -> dict:
    # Apply isolation security group (deny all except SSM)
    # Tag as ISOLATED — do NOT terminate
    ec2.modify_instance_attribute(InstanceId=instance_id, Groups=[CONTAINMENT_SG])

Credential Revocation — deactivates keys AND injects a DenyAll session policy:

1
2
3
4
5
6
7
deny_policy = {
    "Statement": [{"Effect": "Deny", "Action": "*", "Resource": "*",
                   "Condition": {"DateLessThan":
                       {"aws:TokenIssueTime": datetime.utcnow().isoformat()}}}]
}
iam.put_user_policy(UserName=entity_name, PolicyName=f"SECURITY-REVOKE-{investigation_id}",
                    PolicyDocument=json.dumps(deny_policy))

Evidence preservation always runs FIRST — EBS snapshots taken before any isolation to preserve forensic state.

Stage 5 — Remediation Agent

Post-containment cleanup:

Remove persistence mechanisms: attacker-created IAM users, access keys, Lambda backdoors
Patch CVEs: AWS SSM Patch Manager triggered for critical security patches
Restore configuration: AWS Config conformance packs re-applied
Create Security Hub findings in ASFF format with investigation traceability
Update controls: WAF rules and GuardDuty threat intel updated with attack patterns

Stage 6 — Reporting Agent

Key metrics reported:

MTTD (Mean Time to Detect): alert_time - first_indicator_time
MTTC (Mean Time to Contain): containment_time - alert_time
MTTR (Mean Time to Resolve): resolution_time - alert_time

Regulatory notifications filed automatically when breach conditions are met.

Evidence archived with S3 Object Lock (COMPLIANCE mode, 7-year retention) for SOX, GDPR, HIPAA compliance.

Try It Yourself

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
git clone https://github.com/its-me-sweta/CyberSecurity_Investigation_Assistant.git
cd cybersecurity-investigation-agent
pip install -r requirements.txt
uvicorn main:app --reload

curl -X POST http://localhost:8000/security/investigate \
  -H "Content-Type: application/json" \
  -d '{
    "alert_id": "GD-2025-001234",
    "source": "guardduty",
    "alert_type": "UnauthorizedAccess:IAMUser/MaliciousIPCaller",
    "severity": "HIGH",
    "affected_resource": "arn:aws:iam::123456789012:user/service-account",
    "region": "us-east-1",
    "principal_arn": "arn:aws:iam::123456789012:user/service-account",
    "source_ips": ["198.51.100.42", "203.0.113.17"],
    "api_calls": ["GetSecretValue", "ListBuckets", "AssumeRole"],
    "vpc_id": "vpc-0a1b2c3d4e5f6"
  }'

Built with Strands Agents SDK · Amazon Bedrock Nova Pro · AgentCore Runtime

# strands-agents # aws-community-builders # agentic-ai # ai # amazon-bedrock

Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.

Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article

Builder Center

Building a Multi-Agent AI Cybersecurity Investigation Agent on AWS with Strands Agents SDK and Amazon Bedrock

sweta jha

Building a Multi-Agent AI Cybersecurity Investigation Agent on AWS with Strands Agents SDK and Amazon Bedrock

Introduction

Architecture Overview

NIST IR Severity Framework

Stage 1 — Threat Intelligence Agent

Stage 2 — Forensic Analysis Agent

Stage 3 — Blast Radius Agent

Stage 4 — Containment Agent

Stage 5 — Remediation Agent

Stage 6 — Reporting Agent

Try It Yourself