Elevating security investigations with generative AI
summary
Shows an implemented pipeline that links Amazon Detective evidence graphs to generative AI summaries (via Amazon Bedrock) and outputs concise findings from real alerts: a Grafana CVE leads to IMDSv1 exposure, a metadata rebind, then credential exfiltration and use. The system builds a graph database of CloudTrail, VPC flow, GuardDuty and Inspector data, summarizes finding groups to speed triage for junior analysts, and supports RAG enrichment so internal context is included. IMDSv1 -> credential exfiltration
AI-written summary · about
chapters (10)
- 0:00Introduction and speaker background
- 1:03Amazon Detective overview and purpose
- 2:57Challenges in security investigations
- 4:24Investigation process with Amazon Detective
- 7:17Threat scenario breakdown
- 10:49Graph database and AI summarization
- 13:18Pivoting through compromised roles
- 14:22Benefits of generative AI in investigations
- 15:04Future of AI in security operations
- 16:06Retrieval augmented generation overview
related talks
55mStreamline security analysis with Amazon Detective
01h 07mEmpowering Security Teams with Generative AI
28mPatterns for scalable security detections on AWS
26mGenerative AI driven sensitive data protection
41mMerging Human Cyber Security Expertise with Generative AI
49mFight Smarter: Accelerate Your SOC with AI Discovered Attacks
35mGenAI Application Security: Not Just Prompt Injection
54mHow to layer threat detection & monitoring security services