eSentire accelerates AI-augmented threat investigation with Anthropic Claude in Amazon Bedrock

eSentire used Anthropic Claude in Amazon Bedrock to augment its managed detection and response security operations.

The system formulates investigation hypotheses from threat indicators, dynamically selects and executes evidence-gathering tools, and produces interactive investigation reports with evidence and reasoning chains.

The company validated model outputs against senior SOC experts and uses AWS services including Lambda, API Gateway, IAM, and CloudWatch to support the production workflow.

1. 01eSentire wanted to eliminate variability in SOC investigations and deliver expert-level threat analysis consistently across more than 2,000 customer organizations.
2. 02The company also wanted transparent, explainable reasoning for security decisions and faster investigation turnaround without sacrificing accuracy.

1. 01Claude in Amazon Bedrock generates investigation hypotheses from initial threat indicators.
2. 02The platform dynamically selects and executes tools in an agentic investigation loop and continues iterating until it reaches an evidence-based decision.
3. 03Interactive reports expose evidence and reasoning chains so analysts and customers can drill into decisions.
4. 04eSentire validated the approach against 1,000 real-world investigations and uses AWS Lambda, Amazon API Gateway, AWS IAM, and Amazon CloudWatch in the production architecture.

1. 0195% alignment with senior SOC expert decisions across diverse endpoint scenarios.
2. 0299.3% of attacks stopped at the first machine.
3. 03Development and deployment cycles reduced from months to days.
4. 04Threat hunting team can create new tools and workflows in hours using natural language interfaces.

• Delivered expert-level threat analysis consistently
• Provided explainable investigation reports
• Accelerated development and deployment cycles
• Enabled rapid creation of tools and workflows