THREAT HUNT AI: HOW WE BUILT AN AI SECURITY ANALYST ON AWS FOR UNDER $500 A MONTH

Summary from the TLDR InfoSec newsletter

Grow Therapy built an agentic threat hunting workflow on AWS that leveraged existing log sources such as Snowflake, CloudTrail, and Datadog for an additional cost of less than $500/month. Users submit a YAML threat hunt request, which then kicks off a five-phase workflow: first, Sonnet gathers relevant data, and then Opus compares the data to existing baselines, enriches and analyzes the context, assigns a confidence score to the findings, and performs adversarial analysis to validate them. False positives are tracked in Snowflake and injected into the adversarial validation step, which has significantly reduced false-positive reports.