AI-powered anomaly detection for AWS Systems Manager Session Manager logs using Amazon Bedrock

This article describes an AI-powered anomaly detection solution for AWS Systems Manager Session Manager logs using Amazon Bedrock to automatically classify sessions and alert security teams to suspicious activity.

• Module 1 automatically analyzes session transcripts when they end and classifies them as Normal, Suspicious, or Critical
• Module 2 enables SOC teams to query session history using natural language through Amazon Bedrock AgentCore
• Detects patterns including credential access, privilege escalation, data exfiltration, reconnaissance, persistence, and defense evasion
• Lambda functions read transcripts from S3, send to Bedrock for analysis, store summaries in DynamoDB, and alert via SNS
• Solution considers full session context including command output and action sequence, not just individual commands
• Deploy via CloudFormation template with configurable model selection and notification endpoints

This solution enables near real-time analysis of Session Manager transcripts at scale, closing security gaps by automatically detecting suspicious patterns while allowing analysts to investigate session history through natural language queries.