A Story About Trying to Streamline GuardDuty Detection Response with DevOps Agent #opsmethod Presentation Materials

I presented a talk titled "A Story About Trying to Streamline GuardDuty Detection Response with DevOps Agent" at the Study Group opsmethod #3 "Operations × Security" held on 2026/09/04.

Thank you to everyone who attended!

I'm sharing the slides and content from the presentation on this blog.

Slides

Below is an introduction to the slide content.

What I Talked About

This is a story about getting AWS DevOps Agent to help with GuardDuty detection response. I built a system where initial investigation runs automatically starting from a detection.

Overview of the flow from GuardDuty detection triggering a DevOps Agent investigation to the results arriving in Slack

About GuardDuty and Detection Operations

Amazon GuardDuty

It is AWS's threat detection service. It detects suspicious activity from audit trails and network logs.

Continuously analyzes logs such as CloudTrail and DNS to detect threats

Response Flow After Detection

I tried DevOps Agent to make the "Investigation" phase faster and bring it closer to a consistent standard regardless of who performs it.

What is AWS DevOps Agent

AWS DevOps Agent

It is a managed AI operations agent provided by AWS.

Starting from alerts from CloudWatch alarms and monitoring tools, it investigates across logs, metrics, and configuration information, then provides an assessment of what is happening and candidate responses.

Its behavior is basically limited to read-only operations, and it does not modify resources.

※ A feature that allows resource updates with approval was recently added

Key Terms and Features

Sample Chat Screen

DevOps Agent web app. You can query infrastructure status via chat

What Kind of System I Built

Architecture Diagram

I built a system where a DevOps Agent investigation runs automatically, triggered by a GuardDuty detection.

Receives Findings in a security aggregation account and launches investigations from Lambda

Using Skills

I use skills to standardize the investigation procedure and output format.

Skill guardduty-finding-triage describing investigation procedures and output format

Slack Integration

With Slack integration, investigation results are posted to a channel.

Investigation start and investigation results are posted in a thread

Closing Thoughts / Reflections

It produces a nice summary! Since the meaning of the Finding Type, the estimated situation, and recommended actions are delivered in a structured format, I felt it makes the initial triage investigation somewhat easier.

However, for someone who has been handling initial investigations for a long time, there is no small amount of content where they think "the investigation results are helpful, but honestly I already knew that." If the only value is seen as reducing time spent on initial investigation, the impact of introducing DevOps Agent could be evaluated as not that significant.

What matters, I felt, is documenting the investigation flow and judgment criteria that existed only in the person's head. Writing an Agent Skill requires verbalizing "what steps are used to investigate" and "which patterns are false positives," and in that process, tacit knowledge becomes explicit knowledge.

I believe DevOps Agent is also useful as a catalyst for turning knowledge into explicit form.

References

• AWS DevOps Agent
• Agent Spaces - AWS DevOps Agent User Guide
• Agent Instructions - AWS DevOps Agent User Guide
• Agent Skills - AWS DevOps Agent User Guide
• I Presented a Talk Titled "AWS Operations Starting with DevOps Agent" | DevelopersIO
• A Story About a CCoE Trying to Streamline GuardDuty Detection Operations in a Multi-Account Environment with AWS DevOps Agent - DevelopersIO