Benefits of Amazon Nova for Faster Security Alert Triage

Your SOC's biggest problem probably isn't missing the attack. It's drowning in the 500 alerts that weren't one.

Amazon Nova, the foundation model family available through Amazon Bedrock, is starting to show up in security alert triage for exactly that reason: closing the noise fast enough that analysts can spend their shift on the alerts that matter. Rapid7 built its case study on this directly, wiring Nova into its Incident Command SIEM to auto-investigate and close benign alerts. The results are public, specific, and worth stealing ideas from.

Benign alerts get closed automatically, and closed correctly

The single biggest number in Rapid7's writeup is accuracy, not speed. Rapid7 reports that its agentic AI alert investigations, built on Nova, close benign alerts with 99.93% accuracy. That number matters more than raw throughput: a triage system that's fast but wrong just moves the false-negative risk from "analyst missed it" to "bot dismissed it." At that accuracy rate, auto-closing stops being a scary idea and starts being a default setting.

Analysts get 200+ hours back every week

Time saved is the metric that gets a SOC director's attention. Rapid7 says the agentic workflows free up more than 200 SOC analyst hours per week across its customer base. That's not hours saved on one alert, it's hours that were previously spent opening a ticket, pulling logs, confirming it's nothing, and closing it, multiplied across every analyst on every shift. Redirect that time to threat hunting or the alerts that actually need a human, and the same headcount covers a lot more ground.

Investigations start before anyone's paged

Rapid7's Laura Grace Ellis described the workflow as one that lets teams "remove noise, prioritize the most likely malicious alerts, and even launch agentic workflows that begin investigations automatically." In practice that means Nova evaluates an incoming alert, builds an investigation plan, and starts pulling the relevant data before a human has even opened the ticket. When someone does look at it, they're reviewing a partially-built case instead of starting from a blank screen.

Analysts get a natural-language shortcut to query languages

Rapid7 also uses Nova for AI-powered LEQL query generation, Rapid7's own query language for its SIEM. Instead of an analyst hand-writing a query to pull auth logs for a specific user over a specific window, they describe what they want and Nova produces the query. That shrinks the ramp time for junior analysts who know what they're looking for but not yet the syntax to ask for it, and it cuts the minutes-per-alert overhead that adds up across a shift.

It's built to resist making things up mid-investigation

A triage assistant that invents an indicator is worse than one that does nothing. AWS's own prompting guidance for Nova on security tasks leans hard on this: assign the model a specific role, define the output structure explicitly, and include rules that block it from inventing indicators, techniques, or values not present in the input. That's a real, checkable constraint you can put in a system prompt, not just a hope:

import boto3
import json

bedrock = boto3.client("bedrock-runtime", region_name="us-east-1")

system_prompt = [{
    "text": (
        "You are a SOC triage analyst. Given an alert and its raw log "
        "context, decide: BENIGN, ESCALATE, or NEEDS_MORE_DATA.\n"
        "Rules:\n"
        "- Only reference IPs, hashes, usernames, or hostnames that "
        "appear in the provided log context. Never invent one.\n"
        "- If the log context is insufficient to decide, return "
        "NEEDS_MORE_DATA and list exactly what log source is missing.\n"
        "- Justify the verdict in two sentences citing the specific "
        "log lines used."
    )
}]

response = bedrock.converse(
    modelId="amazon.nova-lite-v1:0",
    system=system_prompt,
    messages=[{
        "role": "user",
        "content": [{"text": alert_payload_json}]
    }],
    inferenceConfig={"temperature": 0}
)

verdict = json.loads(response["output"]["message"]["content"][0]["text"])

Set the temperature to 0 for triage: you want the same alert to get the same verdict every time, not creative variation. The NEEDS_MORE_DATA branch is what keeps the model from guessing when the logs genuinely don't answer the question.

When it's not worth it

None of this replaces a SOC analyst on ambiguous or high-severity alerts, and Rapid7 isn't claiming it does. The gains above are concentrated on high-volume, low-ambiguity noise: the alerts that are benign 95% of the time and just need someone (or something) to confirm it. If your SOC's alert volume is already low, or your alerts skew toward genuinely novel or targeted activity, the accuracy and hours-saved numbers won't repeat, because there's no bulk noise to cut in the first place. This is a volume play, not a replacement for investigative judgment.

If your SOC is buried in low-value alerts, that's the queue to point Nova at first, not your hardest cases.