Reco transforme les alertes de sécurité grâce à Amazon Bedrock

This post is cowritten by Tal Shapira and Tamir Friedman from Reco. Reco helps organizations strengthen the security of their software as a service (SaaS) applications and accelerate business without compromise. Using Anthropic Claude in Amazon Bedrock , Reco tackles the challenge of machine-readable security alerts that SOC teams struggle to quickly interpret. This implementation helps transform raw alerts into intuitive, human-readable insights, optimizing security operations with AI-powered analytics that help enhance threat detection, streamline alert processing, and provide the contextual intelligence needed for faster response times and improved risk mitigation. In this blog post, we show you how Reco implemented Amazon Bedrock to help transform security alerts and achieve significant improvements in incident response times. Reco selected Amazon Bedrock for this solution because of its comprehensive advantages in deploying generative AI capabilities. Amazon Bedrock provides access to multiple foundation models from leading AI providers, enabling the flexibility to choose the optimal model for specific use cases. The service offers built-in security features including data encryption, virtual private cloud (VPC) integration, and compliance alignment with industry standards, helping to ensure that sensitive data remains protected throughout the AI workflow. Its pay-per-use pricing model removes upfront infrastructure costs and scales automatically with demand, making it cost-effective for variable workloads. Additionally, developers can use the API-based architecture of Amazon Bedrock to integrate AI capabilities into their applications, so they can build sophisticated AI-powered solutions while maintaining control over their application architecture and data flow. The challenge: Making security alerts actionable Modern security alerts are often highly technical, requiring security engineers to manually analyze raw event data, cross-reference indicators across multiple security alerts, determine potential impact and appropriate responses, derive actionable insights, and communicate findings to non-technical stakeholders. This process is time-consuming and increases the risk of missing critical threats. This raises two challenges: Alert comprehension – How to turn structured alert data into meaningful insights security teams can quickly grasp Investigation and remediation – How to automate the process of suggesting investigation queries and remediation actions based on the alert context The solution: Reco Alert Story Generator Reco’s Alert Story Generator is a core component of the Reco solution that addresses these challenges through four key capabilities: Alert transformation – Converts complex JSON alert data into clear, actionable narratives that security teams can quickly understand Risk correlation – Analyzes multiple data points to identify key security risks, assesses potential impact, and prioritizes response actions Cross-team communication – Generates self-explanatory alert summaries for seamless sharing between security and business stakeholders Automated investigation – Creates ready-to-execute investigation queries that help analysts dive deeper into suspicious activities without manual query construction Technical implementation The Alert Story Generator uses a sophisticated prompt engineering approach that combines: Using carefully selected examples for few-shot learning to facilitate consistent output quality. The transition from the zero-shot to the few-shot approach significantly improved the consistency of structured outputs generated by the language model. Implementation of contextual prompting that uses alert metadata and historical patterns. This approach includes injecting specific row data for each alert while providing dynamically selected few-shot examples tailored to the alert’s source and type. Amazon Bedrock prompt caching to help reduce inference latency by 75% This AI-powered approach helps transform what was traditionally a manual, time-intensive process into an automated workflow that can deliver immediate insights while maintaining the depth and accuracy security teams require. Pipeline architecture To understand how these technical components work together, let’s examine the end-to-end processing pipeline that powers Reco’s alert transformation system, as shown in the following chart: The workflow follows these key steps, orchestrating data from raw alert to actionable insight: User selects an alert to investigate in the UI. The alert, in JSON format, is retrieved from the database. The alert JSON, few-shot prompt, and golden examples are joined together to generate a prompt for identifying suspicious patterns and anomalies and providing actionable, prioritized response recommendations. A contextualized prompt is sent to Anthropic Claude Sonnet in Amazon Bedrock. The system sends the response back to the client for rendering. The workflow, shown in the following