This course was developed by members of AWS Technical Field Communities (TFC), an AWS community of technical experts. The content is intended to complement our standard training curriculum and augment your AWS learning journey. We are aware some courses have accessibility limitations and are working to address. If you require accommodation, please contact AWS Training and Certification Customer Support.
This course provides a practical introduction to building an agentic Security Operations Center (SOC) teammate on AWS using Amazon Quick Suite, Amazon Bedrock AgentCore, and Strands Agents (an open-source agent framework maintained by AWS). The session opens with the SOC scaling gap: alert volumes keep rising while SOC headcount does not, leaving many teams stuck routing alerts rather than running real security operations.
We examine why an AI-enabled teammate is the right answer — one that:
- Correlates findings across Amazon GuardDuty, AWS CloudTrail, and Amazon VPC Flow Logs
- Validates them against a centralized security data lake (e.g., Amazon Security Lake or a customer-managed log store)
- Recommends remediation while keeping analysts in command
Participants will see a demonstration in which the agent triages a non-synthetic GuardDuty finding from a sandbox account, enriches it via Amazon Athena, and proposes containment through AWS Systems Manager Documents — all gated by human approval. The session also covers how Amazon Quick Suite, Bedrock AgentCore, and Strands extend with custom tools and Model Context Protocol (MCP) integrations to connect your Configuration Management Database (CMDB), security data lake, and response playbooks, and closes with a working blueprint and code references that participants can adapt to their own environment.
