Problem Introduction
AWS GuardDuty detects suspicious activity and potential threats across AWS environments. Security teams still need to review findings, understand their severity, and decide which events need immediate investigation. This takes time, especially when teams must correlate activity details, affected resources, and potential security risks.
How GRiPO Helps You in This Situation
The challenge isn’t having different tools, it’s getting them to work together. When the output of one system has to feed another for analysis, action, or AI insights, teams end up moving data manually, maintaining custom scripts, or building complex ETL pipelines. GRiPO Flow connects these tools into a single workflow where data, insights, AI analysis, and actions flow between systems automatically, reducing manual effort and helping teams prioritize suspicious activity.
GRiPO Solution
Jev is a System One model designed to make fast, structured decisions. Instead of generating text, it returns a defined decision that can be used directly for routing and automated actions. GRiPO supports jev as a plugin. In this workflow:
- On-Demand Trigger: runs the triage whenever the team needs to assess a security finding.
- GuardDuty Data: retrieves finding information using the finding ID and region, including finding type, severity, affected resource, associated action, and threat intelligence matches.
- AI Context: organizes the finding data into a structured context for jev.
- jev Noul: evaluates the context and returns a structured decision.
- AI Assessment: combines the finding details with jev’s decision to generate a structured assessment with risk score, key findings, and missing evidence.
- Slack Alert: sends the assessment to the configured Slack channel.
Automated AWS GuardDuty Finding Triage
The workflow runs on demand. It retrieves a GuardDuty finding, prepares the AI context, uses jev to make a structured decision, generates an AI assessment, and posts it to Slack. In the example run, jev’s decision score and the risk score are both 0.72, with GuardDuty severity 8. The report highlights potential unauthorized access to EKS cluster resources by the unauthenticated system:anonymous user. No threats were found in the threat intelligence lists, but the team should review the cluster’s RBAC permissions and verify whether the access is authorized.