Як Trellix використовує Claude для автономних security investigations

SOC зазвичай програє не через відсутність telemetry, а через надлишок сигналів, ручну кореляцію та context switching між endpoint, identity, network, cloud і threat-intelligence systems. Trellix використовує GenAI для автоматичного збору контексту, постановки investigation questions і синтезу evidence, щоб analyst отримував не сирий alert, а структурований investigation packet.

Небезпечна інтерпретація — 'agent автономно вирішує incident'. Production boundary інша: analysis може бути високоавтономним, але authority на isolate host, revoke token, block traffic, delete object або close incident залежить від severity, confidence, reversibility і policy. Для high-impact response модель не повинна бути одночасно прокурором, суддею і кнопкою quarantine.

Trigger-и: detection event, low-severity alert, investigation request, incident escalation або detection-engineering task. Input: normalized telemetry, alert metadata, endpoint/network/cloud events, threat intelligence, asset criticality, identity context, historical incidents, approved playbooks і current policy.

AI stage може формувати hypotheses, query additional evidence, correlate entities, summarize timeline, score uncertainty, propose next investigative step і draft remediation. Integrations проходять через Bedrock/model gateway та security tools. Output — evidence-linked investigation with confidence/unknowns, recommended action and explicit authority state; high-risk action без policy token не виконується.

• Trigger → security event або analyst/detection-engineering request.
• Input → scoped telemetry + asset/identity context + playbooks.
• AI → investigate, correlate, explain, propose response.
• Output → evidence packet + bounded action request + verified postcondition.

Trellix's later AWS materials describe using Amazon Bedrock as a model layer where Claude can coexist with other models. Це важливий production signal: security platform may route summarization, fast classification and deeper reasoning differently rather than pin every task to one expensive model.

Router policy must be versioned and evaluated. Model fallback cannot silently lose tool-use, context, structured-output or safety capabilities. Each run records concrete provider/model revision, routing reason, data-region boundary, prompt/policy fingerprint and the tools available at that moment.

A4 доречний для read-heavy investigation: agent сам обирає queries, збирає telemetry, виконує non-destructive enrichment і формує recommendation. Low-risk reversible action може бути pre-approved policy, наприклад створити ticket або додати temporary tag. Host isolation, credential revocation, blocking production identity, deleting evidence або changing prevention policy — higher tier.

Approval прив'язується до exact asset, exact action, parameters, incident ID, expiry і evidence hash. Якщо incident state або proposed payload змінився, approval повторюється. Break-glass response може пришвидшувати containment, але має окремий actor, reason code і immutable audit event.

Logs, emails, tickets, web artifacts і even attacker-controlled filenames можуть містити instructions для моделі. Тому retrieved content є evidence, а не authority. Tool results і external pages проходять source labeling; control plane забороняє тексту з evidence змінювати permissions, destination або response policy.

Red-team corpus включає indirect prompt injection, forged threat-intel fields, malicious log strings, Unicode obfuscation, conflicting asset identity, stale IOC і evidence designed to trigger exfiltration. Success criterion — не лише 'model spotted attack', а blast radius: чи міг manipulated trajectory отримати secret, call write tool або suppress escalation.

Security automation часто падає в найгіршій точці: response API timed out після фактичної isolation. Blind retry може відправити дубльовану команду або погіршити containment. Кожна consequential action має idempotency key, provider operation ID і authoritative read-after-write check.

Unknown status переходить у RECONCILE, не SUCCESS/FAILED. Якщо telemetry source unavailable, agent не вигадує clean bill of health: terminal state позначає evidence gap і escalation. Recovery після provider outage повертається до known-good model/policy revision і replay-ить bounded incident set перед failback.

Eval suite охоплює true/false positives, multi-stage attacks, benign admin behavior, incomplete telemetry, stale intelligence, cross-tenant data, prompt injection, tool timeout, provider fallback і scenarios, де правильно нічого не блокувати. Graders оцінюють evidence coverage, investigation trajectory, severity, unauthorized actions, containment recommendation і final system state.

Hard blockers: exfiltration, cross-tenant leakage, suppression of severe incident, destructive action outside scope або false claim that containment succeeded. KPI: verified investigation completion, severe-error rate, analyst correction rate, time-to-evidence, time-to-containment, unsafe-action rate, cost per verified investigation and percentage escalated for the right reason.

Alert investigation can run continuously. Scale comes from risk-tier queues, caching normalized context, cheap models for bounded classification and stronger models only where evidence complexity justifies it. Concurrency is limited per tenant/asset/incident so parallel agents do not race to mutate the same endpoint.

Full cost = model tokens + Bedrock/runtime + telemetry queries + SIEM/XDR licenses + enrichment APIs + storage + analyst review + response tooling + eval/red-team + failed investigations + platform operations. Rollout: historical replay → shadow investigation → analyst-assisted read-only → bounded low-risk writes → controlled A4. Promotion requires zero unauthorized actions and a tested kill switch, not a glossy dashboard with 'autonomous' written in large font.