From SIEM Alerts to Action: Building an AI-Powered SOC with Amazon Bedrock Agents

Modern Security Operations Centers (SOCs) are no longer challenged by detecting threats alone they are increasingly challenged by investigating them at scale. As organizations adopt cloud-native architectures and generate ever-growing volumes of security telemetry, SIEM platforms continuously produce alerts that require timely analysis, contextual enrichment, and informed decision-making.

To address this challenge, we built an AI-driven alert triage solution using Amazon Bedrock Agents that automates the initial stages of SIEM alert investigation. Instead of presenting analysts with raw alerts, the solution automatically enriches them with contextual information, correlates related events, retrieves relevant threat intelligence, and generates a structured investigation summary before human review. High-confidence threats are escalated to our Tier-2 (L2) security team, while eligible false positives can be automatically closed with feedback routed to detection engineering for continuous improvement.

In this blog, we explore the architecture behind the solution, explain how we evaluated and selected the most suitable foundation model, and share the engineering decisions and lessons learned while building an AI-assisted alert triage workflow.

The Challenge with Manual L1 Triage

Every alert initiates a familiar investigation workflow: analysts gather contextual information from multiple sources, validate indicators of compromise (IOCs), review historical activity, consult threat intelligence platforms, and determine whether the alert warrants escalation. While each individual investigation is relatively straightforward, repeating the same workflow hundreds of times every day consumes valuable analyst time, increases response times, and contributes to alert fatigue.

In a traditional SOC, this initial triage is performed by Tier-1 (L1) analysts, who escalate genuine threats to Tier-2 (L2) responders. This manual triage model presents three fundamental operational challenges:

• Latency: Every alert waits for analyst attention, during off-hours or periods of high alert volume, queues grow, delaying acknowledgement and increasing the time required to begin an investigation.
• Inconsistency: Investigation quality can vary depending on analyst experience, the availability of contextual information, and the depth of manual analysis, making it difficult to ensure a consistent and repeatable triage process.
• Scalability: As alert volumes continue to grow, maintaining 24/7 coverage requires additional analyst effort. Manual triage scales linearly with headcount, eventually becoming a bottleneck in the detection-to-response pipeline.

The objective is not to replace human analysts, but to eliminate the repetitive evidence-gathering tasks that consume much of their time. By automating the initial stages of alert investigation, analysts can focus on activities where human judgment provides the greatest value: validating findings, investigating confirmed threats, and coordinating incident response.

Reimagining Alert Investigation

SIEM alert investigation is rarely a linear process. Every alert presents a different combination of indicators, context, and supporting evidence, requiring analysts to determine what information is relevant before reaching a conclusion. Unlike predefined operational workflows, the investigation path depends entirely on the alert itself.

The conventional approach is to automate investigations using rule-based workflows or SOAR playbooks, where each alert type follows a predefined sequence of actions. While effective for repetitive tasks, this model becomes increasingly difficult to maintain as detection rules, log schemas, and security tooling continue to evolve. As the environment grows, the operational burden shifts from analysts performing investigations to engineers maintaining hundreds of automation workflows.

Instead of building static playbooks for every investigation scenario, we wanted a system capable of reasoning over security context and dynamically adapting its investigation based on the evidence available.

Amazon Bedrock Agents enabled this approach. Unlike traditional automation, the agent can dynamically orchestrate multiple investigation tools based on the context of each alert, allowing a single workflow to handle diverse security scenarios without requiring a dedicated playbook for every detection rule. Rather than executing a fixed sequence of actions, the agent interprets the incoming alert, determines which tools to invoke, retrieves additional context when required, correlates the collected evidence, and generates a structured investigation summary. The investigation adapts to the alert instead of forcing every alert through the same predefined workflow.

Dynamic reasoning, however, does not imply unrestricted behaviour. Each agent operates within carefully defined guardrails, with access only to approved read-only tools, tightly scoped instructions, and a predefined response schema. This balance between adaptive reasoning and controlled execution enables the system to automate repetitive investigative tasks while maintaining consistency, traceability, and analyst trust.

The AI-Driven SIEM Triage Architecture

Solution Architecture

To automate SIEM alert investigation without disrupting our existing SOC workflow, we designed an event-driven architecture that integrates Amazon Bedrock Agents directly with our OpenSearch-based SIEM. Rather than introducing another security platform, the solution extends the existing detection pipeline by automating the investigation phase immediately after an alert is generated.

Domain-Specific Bedrock Agents

Instead of relying on a single generic agent to investigate every security event, we adopted a domain-driven approach by deploying three specialized Amazon Bedrock Agents. Each agent is responsible for investigating alerts within a specific security domain, allowing it to operate with focused instructions, domain-specific knowledge, and relevant investigation tools.

• AWSSecurityAgent investigates findings generated from AWS services such as GuardDuty, IAM, S3, and AWS Security Hub.
• OnPremSecurityAgent handles alerts originating from on-premises infrastructure, including firewalls, endpoint security solutions, and Active Directory.
• ThirdPartySecurityAgent investigates security events generated by third-party SaaS platforms and external security products.

Specializing agents in this way significantly reduces prompt complexity, improves tool selection, and allows each agent to reason using the schemas, telemetry, and attack patterns relevant to its domain. This approach produced more consistent investigation results than relying on a single general-purpose agent.

Investigation Pipeline

The complete investigation workflow is illustrated in the architecture diagram below.

Once an alert is generated by OpenSearch Alerting, it is published to an Amazon SNS topic, which serves as the entry point to the AI investigation pipeline.

An AWS Lambda routing function receives the event, determines the originating log source by examining the alert metadata and index pattern, and invokes the appropriate Bedrock Agent. This routing mechanism ensures that every alert is investigated by the agent best suited to its security domain.

After receiving the alert, the Bedrock Agent begins orchestrating multiple investigation tools. Using Bedrock's tool invocation capabilities, the agent retrieves additional evidence from OpenSearch through a dedicated Lambda function running inside a private VPC, allowing it to collect surrounding log events and historical context related to the alert.

Depending on the indicators extracted during the investigation, the agent can also enrich the alert using integrated threat intelligence sources, cloud security findings, and endpoint telemetry. Rather than following a predefined sequence of actions, the agent dynamically determines which information is required based on the context of the alert and continues gathering evidence until sufficient context is available for analysis.

Once the investigation is complete, the agent produces a standardized JSON verdict containing a summary of its findings, an assessed severity, a recommended next action, and investigation tags: {Summary, Severity, Recommendation, Tags}. Standardizing every investigation into a consistent output schema ensures that alerts are evaluated uniformly regardless of alert type or security domain.

Finally, the investigation result determines the next stage of the workflow. High-confidence security incidents are automatically escalated to the Tier-2 (L2) security team by creating a Jira ticket and sending a Google Chat notification. Not every alert classified as a false positive is automatically closed. Only alerts that satisfy predefined operational policies and are assessed as low risk are eligible for automated closure. All auto-closed alerts remain auditable and are periodically sampled by Tier-2 analysts to validate the AI's assessment and improve both the investigation workflow and SIEM detection rules. Structured feedback is provided to detection engineers to continuously improve detection rules and reduce future alert noise.

One of the most important architectural decisions was standardizing every investigation into a structured output. Unlike manual investigations, where findings often vary depending on the analyst, every AI-assisted investigation produces the same auditable artifact. This not only improves investigation consistency but also enables investigation quality to be measured, compared against analyst decisions, and continuously refined over time.

Choosing the Right Model: An Evaluation That Surprised Us

One of the biggest assumptions in generative AI is that larger models always produce better results. For security investigations, however, accuracy, consistency, and structured output are far more important than model size alone. Rather than selecting a foundation model based on specifications or benchmarks, we evaluated multiple Amazon Nova models using real security alerts from our environment.

Our evaluation focused on three key criteria:

• Investigation accuracy – Could the model correctly identify the security issue and prioritize the most critical finding?
• Output quality – Did the model generate a complete and well-structured investigation summary suitable for downstream automation?
• Cost efficiency – Could the model deliver reliable results while remaining practical for large-scale SOC operations?

To ensure a fair comparison, we provided the same Security Hub alert payload and identical surrounding log context to each model. Every model received the same prompt, the same investigation instructions, and access to the same contextual information. This allowed us to compare the models solely on the quality of their investigation rather than differences in prompting or available data.

The evaluation produced an unexpected result. While the larger models generated detailed responses, they did not consistently identify the most critical security finding. Amazon Nova Lite, despite being the smallest and most cost-effective model in our evaluation, produced the most accurate investigation by correctly identifying the highest-risk issue, returning a valid structured JSON response, and providing precise remediation guidance.

The outcome reinforced an important engineering lesson: selecting a foundation model for security operations should be driven by empirical evaluation rather than model size or pricing tier. For production SOC workflows, accuracy, deterministic output, and operational cost proved to be more valuable than simply using the largest available model.

While the model evaluation helped us select the most suitable foundation model, the more important question was whether AI-assisted triage could improve day-to-day SOC operations. To answer this, we compared our AI-driven investigation workflow against the existing manual Tier-1 triage process.

Putting AI Triage to the Test

To assess the effectiveness of the proposed architecture, we compared the AI-driven investigation workflow with the existing manual Tier-1 (L1) triage process. The objective was not simply to measure how quickly an alert could be processed, but to evaluate whether AI could improve investigation consistency, reduce repetitive analyst effort, and scale more effectively as alert volumes increased.

The comparison focused on key operational characteristics of the investigation process, including response time, contextual enrichment, investigation consistency, and scalability.

Operational Comparison

From an operational perspective, the AI-driven workflow consistently outperformed the traditional investigation model in areas where manual triage typically becomes a bottleneck. Rather than requiring analysts to manually gather evidence from multiple systems, the Bedrock Agent automatically retrieved contextual information, correlated historical observations, and generated a structured investigation summary before the alert reached the analyst.

This standardized workflow ensured that every alert underwent the same investigation process regardless of alert type, analyst availability, or workload. The result was not only faster investigations but also more consistent and repeatable triage decisions.

From a cost perspective, the event-driven architecture built on Amazon SNS, AWS Lambda, and Amazon Bedrock Nova Lite operates at a fraction of the cost of maintaining a fully manual Tier-1 investigation process while providing continuous, 24×7 coverage.

A Practical Example

The difference becomes more apparent when comparing the investigation workflow itself.

Although both approaches ultimately reach the same investigation outcome, the analyst's role changes significantly. Instead of spending time collecting evidence and switching between multiple security tools, analysts receive a structured investigation summary containing the relevant context, supporting evidence, severity assessment, and recommended next steps.

By automating repetitive evidence gathering while preserving human oversight for validation and response, the AI-driven workflow allows security analysts to focus on higher-value activities such as incident response, threat hunting, and root cause analysis.

Evaluating the Workflow in Production

While the previous comparison summarizes the expected characteristics of AI-assisted investigation, the following observations were collected after deploying the workflow in our production SOC. After deploying the solution in our SOC, we observed the following while processing production security alerts.

The production data reinforced two key observations. First, the most significant improvement was not simply faster investigations, but consistent coverage. Every alert now undergoes the same investigation workflow, receives contextual enrichment, and produces a standardized investigation summary regardless of when it is generated or analyst availability. Second, standardizing investigation outputs into a consistent JSON schema enables investigations to be audited, compared, and continuously refined against Tier-2 analyst outcomes, something that was considerably more difficult when investigations existed only as free-form notes.

As adoption continues, we are expanding our evaluation dataset to measure long-term agreement between AI-generated investigation summaries and Tier-2 analyst decisions. These measurements will help guide future improvements to the investigation workflow and determine where automation can be safely extended while maintaining human oversight

Human Oversight and Guardrails

Automating alert triage does not mean automating security decisions. While the Bedrock Agents significantly reduce the manual effort required to investigate alerts, human analysts remain responsible for validating findings, responding to confirmed threats, and making operational decisions.

The investigation pipeline treats security telemetry as untrusted evidence. Agent instructions remain isolated from alert content, and the Bedrock Agent operates only on approved investigation tools and structured inputs. This ensures attacker-controlled log fields cannot modify the agent's behaviour or bypass operational guardrails.

To ensure the investigation workflow remains reliable and trustworthy, several guardrails were intentionally built into the system:

Tier-2 investigations remain fully human. Every high-confidence security incident is reviewed, investigated, and resolved by the security team. The AI accelerates investigations but never performs containment or remediation actions.

Continuous False-Positive Validation

False-positive handling does not end when an alert is automatically closed. Instead, every AI-generated investigation becomes part of a continuous feedback loop designed to improve both the AI investigation workflow and the underlying detection content.

Alerts classified as low-risk or likely false positives are periodically sampled and reviewed by Tier-2 analysts. During this review, analysts compare the AI-generated investigation summary with the final investigation outcome to determine whether the classification was correct and whether any important context was overlooked.

Each review helps answer several important questions:

• Was the alert correctly classified?
• Did the Bedrock Agent miss any relevant evidence?
• Was the investigation sufficiently comprehensive?
• Was the severity assessment appropriate?
• Did the agent retrieve the right contextual information?
• Is the SIEM detection rule generating unnecessary noise?

Rather than treating these reviews as simple pass/fail checks, the findings are incorporated into the engineering lifecycle to continuously improve the system. Depending on the outcome of the review, different parts of the investigation pipeline may be refined:

• Agent Instructions – Refine the Bedrock Agent's system instructions to improve reasoning for similar investigation scenarios.
• Knowledge Base and Investigation Playbooks – Expand internal guidance and investigation procedures so future alerts are enriched with better contextual information.
• Detection Engineering – Tune noisy SIEM detection rules, adjust thresholds, or improve correlation logic to reduce recurring false positives.

This creates a closed feedback loop in which analysts decisions continuously improve the investigation pipeline without requiring retraining of the underlying foundation model. Each validated investigation strengthens the prompts, detection content, and evaluation process, ensuring the system becomes more reliable over time while remaining fully governed by human oversight.

An AI triage layer that incorrectly dismisses a genuine security incident introduces greater operational risk than a slower manual investigation. Continuous sampling, analyst validation, and iterative refinement are therefore not optional safeguards they are the control mechanisms that make AI-assisted automation trustworthy.

Agents operate with read-only permissions. Bedrock Agents are limited to retrieving logs, contextual information, and threat intelligence. They cannot modify infrastructure, change configurations, access credentials, or execute remediation workflows.

Human oversight remains a fundamental part of the architecture. An AI system that occasionally misclassifies a genuine security incident can introduce greater operational risk than a slower manual process. By combining automated investigation with human validation and continuous measurement, the system delivers both operational efficiency and security confidence.

Conclusion

Security Operations Centers have become increasingly effective at detecting threats, but investigating the growing volume of alerts remains a major operational challenge. Our production deployment demonstrated that AI-assisted triage can reduce the time to begin investigations, provide continuous 24/7 coverage, prevent investigation queue backlogs, and standardize investigation outputs while maintaining human oversight.

By integrating Amazon Bedrock Agents with our OpenSearch-based SIEM, we transformed the initial stages of alert investigation into an AI-assisted workflow that automatically enriches alerts, correlates contextual evidence, and generates structured investigation summaries within seconds. Our evaluation reinforced an important engineering lesson: success depended less on selecting the largest language model and more on combining the right model with domain-specific agents, structured outputs, and well-defined guardrails.

AI is not replacing security analysts. It is augmenting them. By automating repetitive investigation tasks while preserving human oversight, organizations can investigate alerts more consistently, respond faster, and scale Security Operations Centers without compromising governance or security.

References

• Amazon Bedrock Agents 
• Configure an action group for your agent 
• Amazon OpenSearch Service 

Bug Bounty

Got what it takes to hack? Feel free to report a vulnerability in our assets and get yourself a reward through our bug bounty program. Find more details about policy and guidelines at https://www.halodoc.com/security

Join Us

Scalability, reliability, and maintainability are the three pillars that govern what we build at Halodoc Tech. We are actively looking for engineers at all levels and if solving hard problems with challenging requirements is your forte, please reach out to us with your resumé at careers.india@halodoc.com

About Halodoc

Halodoc is the number one all-around healthcare application in Indonesia. Our mission is to simplify and deliver quality healthcare across Indonesia, from Sabang to Merauke. Since 2016, Halodoc has been improving health literacy in Indonesia by providing user-friendly healthcare communication, education, and information (KIE). In parallel, our ecosystem has expanded to offer a range of services that facilitate convenient access to healthcare, starting with Homecare by Halodoc as a preventive care feature that allows users to conduct health tests privately and securely from the comfort of their homes; My Insurance, which allows users to access the benefits of cashless outpatient services in a more seamless way; Chat with Doctor, which allows users to consult with over 20,000 licensed physicians via chat, video or voice call; and Health Store features that allow users to purchase medicines, supplements and various health products from our network of over 4,900 trusted partner pharmacies. To deliver holistic health solutions in a fully digital way, Halodoc offers Digital Clinic services including Haloskin, a trusted dermatology care platform guided by experienced dermatologists. We are proud to be trusted by global and regional investors, including the Bill & Melinda Gates Foundation, Singtel, UOB Ventures, Allianz, GoJek, Astra, Temasek, and many more. With over USD 100 million raised to date, including our recent Series D, our team is committed to building the best personalized healthcare solutions, and we remain steadfast in our journey to simplify healthcare for all Indonesians.