Greenlight builds autonomous SOC on Bedrock AgentCore, 90% of 4,000 monthly cases auto-resolved
AWS ML Blog · rss · 2026-11-07
AWS ML Blog details how Greenlight Financial built Luna, an autonomous SOC on Amazon Bedrock AgentCore resolving 90%+ of up to 4,000 monthly security/risk cases without humans. Key points:
- Tiered multi-agent architecture: A Tier 1 supervisor orchestrates 30+ specialized agents (identity, EDR, observability, payments, threat intel, SOAR), triaging routine cases in single-digit seconds; a Tier 2 supervisor with extended reasoning handles the 10% needing multi-source, multi-step investigation with evidence chains.
- Memory layer: 30-day episodic memory auto-allowlists known patterns (e.g. a weekly maintenance access pattern), long-term memory encodes stats like a 73% false-positive rate from a dark web source, and a case-learnings pipeline records patterns confirmed three times.
- Entry points include Tines SOAR ingestion, direct APIs, and a Claude Desktop extension for on-call engineers.
A practical blueprint for autonomous security operations in regulated industries.
More from coding & agent
- Building self-evolving systems: running dozens of research workflows daily, the real job is filtering — EXM7777 · 2026-11-07
- 1,500 unique agents paid in 18 hours, nearly 3x the prior period — adamamcbride · 2026-11-07
- Infinite Factory: endless robot factory generated live in-browser with WFC and OpenUSD — mishig25 · 2026-11-07
- Claude Code usage-limit fix: offload small tasks to DeepSeek, first task cost $0.0043 — PrajwalTomar_ · 2026-11-07
- 7 new MCP servers this week, including one that phones you when your agent gets stuck — Prior_Engineering486 · 2026-11-07
- Dev replaces vector-search RAG with Markdown + knowledge graphs via Claude CLI, claims ~95% fewer hallucinations — Shivam__kumar · 2026-11-07