enrich-with-aws-security-agent

Enriching Investigations with AWS Security Agent Findings

When to Use — AUTOMATIC ACTIVATION

Load this skill automatically when ANY of these conditions apply:

Application-Level Symptoms (even without explicit security context)

• Application pages or endpoints are not loading or returning errors
• Unexplained service outages with no recent deployments
• Application behaving unexpectedly without clear infrastructure cause
• Services returning 4xx/5xx errors without obvious resource exhaustion

Explicit Security Signals

• Security vulnerabilities or misconfigurations mentioned
• Suspicious code patterns or behaviors observed
• Authentication or authorization failures
• Injection vulnerabilities suspected (SQL, command, SSRF, etc.)
• Sensitive data exposure concerns
• Security-related errors in application logs
• Findings that suggest code-level security issues

Key Insight

Many security issues (like SSRF, injection attacks, or compromised dependencies) manifest as application outages or errors rather than obvious security alerts. When an app stops working and there's no clear infrastructure cause (no deployments, no resource exhaustion, no config changes), always check for security issues.

Overview

AWS Security Agent is an AI-powered security service that performs automated code security reviews and penetration testing. Its findings are stored in CloudWatch Logs and provide detailed, actionable information about vulnerabilities including exact file locations, line numbers, and remediation guidance.

Steps

1. Identify the relevant CloudWatch log group for AWS Security Agent findings. Look for log groups with patterns like:

   • /aws/securityagent/*
   • Log groups containing "security-agent" or "securityagent" in the name

2. Query the Security Agent logs using CloudWatch Logs Insights:

   fields @timestamp, @message
   | filter @message like /finding|vulnerability|issue|risk/
   | sort @timestamp desc
   | limit 100