A Story About Trying to Streamline GuardDuty Detection Response with DevOps Agent #opsmethod Presentation Slides

I presented a talk titled "A Story About Trying to Streamline GuardDuty Detection Response with DevOps Agent" at the Study Session opsmethod #3 "Operations × Security" held on 2026/09/04.

Thank you to everyone who attended!

I will share the slides and content from the presentation on this blog.

Slides

The following is an introduction to the slide content.

Topics Covered

This is a story about having AWS DevOps Agent assist with GuardDuty detection response. I built a mechanism that automatically runs an initial investigation triggered by a detection.

Overview of the flow from a GuardDuty detection triggering a DevOps Agent investigation to the results arriving in Slack

About GuardDuty and Detection Operations

Amazon GuardDuty

It is AWS's threat detection service. It detects suspicious activity from audit trails and network logs.

Continuously analyzes logs such as CloudTrail and DNS to detect threats

Response Flow After Detection

I tried DevOps Agent to make the "Investigation" phase faster and bring it closer to a consistent standard regardless of who performs it.

What Is AWS DevOps Agent

AWS DevOps Agent

It is a managed AI operations agent provided by AWS.

Triggered by alerts from CloudWatch alarms and monitoring tools, it investigates across logs, metrics, and configuration information to provide an assessment of what is happening and candidate responses.

Its behavior is principally limited to read-only operations and does not modify resources.

※ A feature that allows resource updates with approval was recently added.

Key Terms and Features

Sample Chat Screen

DevOps Agent Web app. You can query infrastructure status via chat

What Kind of Mechanism Was Built

Architecture Diagram

I built a mechanism that automatically runs a DevOps Agent investigation triggered by a GuardDuty detection.

Receives Findings in a security aggregation account and launches the investigation from Lambda

Utilizing Skills

Skills are used to standardize investigation procedures and output format.

Skill guardduty-finding-triage describing investigation procedures and output format

Slack Integration

With Slack integration, investigation results are posted to a channel.

Investigation start and investigation results are posted in a thread

Closing Thoughts / Impressions

It produces a nicely structured summary! Since the meaning of the Finding Type, the estimated situation, and recommended actions are delivered in a structured format, I felt it eases the initial triage investigation to a reasonable degree.

However, for those who have been handling initial investigations for a long time, there is no small amount of content where the reaction is "the investigation results are helpful, but honestly I already knew that." If the only value is seen as reducing the time spent on initial investigations, the assessment could be that the impact of introducing DevOps Agent is not that significant.

What I felt is truly important is documenting the investigation flow and judgment criteria that existed only in the minds of the people responsible. Writing Agent Skills requires articulating "what procedure is used for investigation" and "which patterns are false positives," and through that process, tacit knowledge becomes explicit knowledge.

I believe DevOps Agent is also valuable as a catalyst for turning knowledge into explicit form.

References

• AWS DevOps Agent
• Agent Spaces - AWS DevOps Agent User Guide
• Agent Instructions - AWS DevOps Agent User Guide
• Agent Skills - AWS DevOps Agent User Guide
• I Presented a Talk Titled "AWS Operations Starting with DevOps Agent" | DevelopersIO
• A Story About Trying to Streamline GuardDuty Detection Operations in a Multi-Account Environment as CCoE with AWS DevOps Agent - DevelopersIO