AWS Threat Containment Agent

A cost-effective, serverless autonomous threat containment system built on AWS. This POC demonstrates how to automatically detect, analyze, and respond to security threats using native AWS services—inspired by the agentic AI patterns announced at AWS re:Invent 2025.

🎯 Overview

This project implements an autonomous security response pipeline that:

1. Detects threats via Amazon GuardDuty
2. Enriches findings with correlated signals from Security Hub
3. Evaluates containment policies (Cedar-inspired rules)
4. Checks incident memory for similar past events
5. Executes containment actions (isolation, forensic snapshots)
6. Notifies the security team via SNS
7. Records episodes for future learning

Why This Project?

After attending AWS re:Invent 2025 and seeing the Amazon Bedrock AgentCore announcements, I wanted to validate the agentic security patterns without committing to expensive managed services upfront. This POC cost approximately $0.15 to build and test.

🏗️ Architecture

┌─────────────────────────────────────────────────────────────────────────┐
│                     GuardDuty (Sample Findings for Testing)             │
└────────────────────────────────┬────────────────────────────────────────┘
                                 │
                                 ▼
┌─────────────────────────────────────────────────────────────────────────┐
│              EventBridge Rule (severity >= 4 filter)                    │
└────────────────────────────────┬────────────────────────────────────────┘
                                 │
                                 ▼
┌─────────────────────────────────────────────────────────────────────────┐
│                    Step Functions State Machine                         │
│                                                                         │
│   ┌─────────┐   ┌─────────┐   ┌─────────┐   ┌─────────────────────┐   │
│   │ Enrich  │──▶│ Check   │──▶│Evaluate │──▶│ Execute Containment │   │
│   │ Finding │   │ Memory  │   │ Policy  │   │  (Parallel Actions) │   │
│   └─────────┘   └─────────┘   └─────────┘   └─────────────────────┘   │
│                                                       │               │
│                      ┌────────────────────────────────┘               │
│                      ▼                                                │
│              ┌──────────────┐   ┌──────────────┐                     │
│              │  Notify SOC  │──▶│Record Episode│                     │
│              │    (SNS)     │   │  (DynamoDB)  │                     │
│              └──────────────┘   └──────────────┘                     │
└─────────────────────────────────────────────────────────────────────────┘

🚀 Quick Start

Prerequisites

• AWS Account with Administrator access
• AWS CLI v2 configured (aws configure)
• Bash shell (Linux/macOS/WSL)
• Python 3.9+ (for test scripts)

One-Command Deployment

# Clone the repository
git clone https://github.com/lshw54/aws-threat-containment-agent-demo.git
cd aws-threat-containment-agent-demo

# Deploy all resources
chmod +x deploy.sh
./deploy.sh

The deployment script will create:

• 1 DynamoDB table (incident memory)
• 1 SNS topic (SOC notifications)
• 7 Lambda functions (containment logic)
• 1 Step Functions state machine (orchestration)
• 1 EventBridge rule (GuardDuty trigger)
• Required IAM roles and policies

Test the Pipeline

# Generate sample findings and verify execution
./scripts/test.sh

Expected output:

🧪 Testing Pipeline...

1️⃣ Generating sample findings...
   ✓ Sample findings generated

2️⃣ Waiting 60 seconds for pipeline execution...

3️⃣ Checking executions...
+------------------------------------------+-----------+
|                   Name                   |  Status   |
+------------------------------------------+-----------+
|  abc123-def456-...                       | SUCCEEDED |
+------------------------------------------+-----------+

4️⃣ Checking DynamoDB...
Count: 1

✅ Test complete! Check your email for SNS notifications.

📁 Project Structure

aws-threat-containment-agent/
├── lambda/
│   ├── enrich_finding.py           # Enrich GuardDuty findings
│   ├── check_incident_memory.py    # Query similar past incidents
│   ├── evaluate_containment_policy.py  # Cedar-inspired policy engine
│   ├── snapshot_for_forensics.py   # Create EBS snapshots
│   ├── isolate_instance.py         # Apply isolation security group
│   ├── notify_soc.py               # Send SNS notifications
│   └── record_episode.py           # Store incident in DynamoDB
├── infrastructure/
│   └── state_machine.json          # Step Functions definition
├── scripts/
│   ├── generate_sample_findings.py # Generate test findings
│   ├── test.sh                     # End-to-end test script
│   └── verify_pipeline.py          # Verification utility
├── docs/
│   └── architecture.png            # Architecture diagram
├── deploy.sh                       # One-click deployment
├── cleanup.sh                      # Resource cleanup
├── diagnose.sh                     # Troubleshooting utility
└── README.md

🔧 Configuration

EventBridge Filter

The default rule triggers on GuardDuty findings with severity >= 4 (Medium and above):

{
  "source": ["aws.guardduty"],
  "detail-type": ["GuardDuty Finding"],
  "detail": {
    "severity": [{"numeric": [">=", 4]}]
  }
}

Finding Type Severities

Finding Type	Severity	Triggers Pipeline?
UnauthorizedAccess:EC2/SSHBruteForce	2.0	❌ No
Recon:EC2/PortProbeUnprotectedPort	5.0	✅ Yes
Backdoor:EC2/C&CActivity.B	8.0	✅ Yes
CryptoCurrency:EC2/BitcoinTool.B	8.0	✅ Yes

Policy Rules

The policy engine (evaluate_containment_policy.py) implements these rules:

Policy	Condition	Action
Sample Finding Safe Mode	isSampleFinding == true	Forensics only, no isolation
High False Positive	falsePositiveRate > 30%	Require human approval
Uncorrelated High Severity	severity >= 7 AND correlationScore < 1	Require human approval
Default	All checks pass	Permit all actions

💰 Cost Estimate

Component	Monthly Cost (Low Volume)
GuardDuty (sample findings)	$0
EventBridge	~$0 (free tier)
Step Functions	~$0.025 per 1K transitions
Lambda	~$0 (free tier)
DynamoDB (on-demand)	~$1.25 per 1M writes
SNS	~$0 (free tier)
Total for POC testing	~$0.15

🔍 Troubleshooting

Run the diagnostic script to identify issues:

./diagnose.sh

Common Issues

EventBridge not triggering Step Functions:

# Check if rule exists and is enabled
aws events describe-rule --name ThreatContainmentTrigger

# Check IAM role permissions
aws iam get-role-policy \
  --role-name ThreatContainmentEventBridgeRole \
  --policy-name InvokeStepFunctions

No sample findings generated:

# Verify GuardDuty is enabled
aws guardduty list-detectors

# Generate high-severity findings
aws guardduty create-sample-findings \
  --detector-id YOUR_DETECTOR_ID \
  --finding-types "Backdoor:EC2/C&CActivity.B"

🚀 Future Enhancements: Path to AgentCore

This POC validates patterns that map directly to Amazon Bedrock AgentCore (announced at re:Invent 2025):

Current Implementation	AgentCore Upgrade
Lambda policy engine	AgentCore Policy (Cedar + natural language)
DynamoDB queries	AgentCore Memory (semantic search)
Direct Lambda invocation	AgentCore Gateway (MCP tool discovery)
No quality monitoring	AgentCore Evaluations (continuous assessment)

🧹 Cleanup

Remove all created resources:

chmod +x cleanup.sh
./cleanup.sh

Note: GuardDuty is NOT disabled by the cleanup script. To disable:

aws guardduty delete-detector --detector-id YOUR_DETECTOR_ID

📚 Related Resources

• AWS re:Invent 2025: AgentCore Announcements
• Amazon Bedrock AgentCore Documentation
• GuardDuty Finding Types
• Cedar Policy Language
• Step Functions Best Practices

🤝 Contributing

Contributions are welcome! Please feel free to submit a Pull Request. For major changes, please open an issue first to discuss what you would like to change.

1. Fork the repository
2. Create your feature branch (git checkout -b feature/AmazingFeature)
3. Commit your changes (git commit -m 'Add some AmazingFeature')
4. Push to the branch (git push origin feature/AmazingFeature)
5. Open a Pull Request

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.