BUILDING AN AWS GUARDDUTY ALERT TRIAGE AGENT

Summary from the TLDR InfoSec newsletter

This article explores how to create a GuardDuty triage agent using PydanticAI and Discord. A user can call the agent using !triage in a Discord channel, and it will investigate a specific alert, IAM user, etc, and provide additional context as well as a verdict. The author was impressed with how well the LLM could triage alerts, but definitely felt that there was a lot of engineering effort in creating the tools and fine-tuning the agent.