Crest Data worked with the customer to extend and harden the platform’s AI analyst, an AI security analyst that automates the investigative and analytical work behind modern security operations, powered by Amazon Bedrock. The AI security analyst is a multi-agent system in which a planning supervisor coordinates a fleet of specialized AI agents to interpret user questions, query security data, build detections, analyze events, and produce analyst-ready answers, while keeping humans in control of consequential decisions. Every unit of reasoning in the platform, from high-level planning to individual sub-agents and background workflows, runs on Amazon Bedrock.

Building on the AI security analyst’s existing Bedrock foundation, Crest Data delivered new capabilities, including a natural-language-to-KQL querying agent and credit-based usage governance for the AI security analyst’s AI consumption, alongside accuracy improvements to existing agents and reliability hardening across the chat experience.

By enhancing a coordinated, agent-based workflow grounded in the customer’s own security data, this collaboration helped the customer expand what analysts can do with the AI security analyst, govern generative AI usage, and improve the consistency and reliability of the platform, all while keeping customer telemetry within the AWS boundary.

About the Customer  

The customer is a cybersecurity company focused on modernizing how organizations collect, understand, and act on security data. The company builds a platform that helps security teams cut through noise, streamline detection and response, and apply generative AI to the day-to-day work of security operations.

The customer developed the AI security analyst, an AI-assisted analysis layer that operates directly on customer security data and integrates with the tools and detection frameworks that security teams already rely on. The AI security analyst is built as a multi-agent system on Amazon Bedrock. Because it works with sensitive customer telemetry, the customer requires that inference stays within a controlled cloud boundary while still delivering enterprise-grade AI capabilities and keeping human judgment in the loop for critical decisions.

Customer Challenge  

With the AI security analyst already in production and adoption growing, the customer faced three interconnected challenges as it prepared the platform for enterprise scale. Analysts needed a faster way to interrogate their security data without hand-writing queries; the business needed to meter and govern generative AI consumption so the AI security analyst’s AI SOC capabilities could be packaged and offered commercially; and the existing agents needed to be more accurate and the overall experience more reliable under real-world load.

These needs sat on top of a platform with strict data-handling requirements. The AI security analyst operates on sensitive customer security telemetry, so any new capability had to keep inference inside a controlled cloud boundary rather than sending data to external model endpoints, and had to fit the AI security analyst’s existing multi-model, multi-agent architecture on Amazon Bedrock rather than introduce parallel model integrations to operate and secure.

The customer engaged Crest Data to deliver these enhancements, adding new agent capabilities, usage governance, accuracy improvements, and reliability hardening, directly on the AI security analyst’s existing Bedrock foundation.

Proposed Solution

The AI security analyst is a multi-agent security assistant built on Amazon Bedrock. A planning supervisor interprets each user request, decomposes it into tasks, and delegates those tasks to specialized agents, each responsible for a distinct capability such as generating insights, building queries, filtering and analyzing events, and taking follow-up actions. Background workflows handle tasks like verdict determination, summarization, and detection-rule creation.

All model access is funneled through a single, uniform layer, giving every agent and workflow consistent concurrency control, retries, and observability, and the platform runs a tiered model strategy on Bedrock, using Anthropic’s Claude Sonnet with extended thinking for reasoning-intensive work, Claude Haiku for high-volume tasks, and Amazon Titan Text Embeddings for semantic caching, all behind Bedrock’s Converse API. Working on this foundation, Crest Data delivered the following enhancements.

Natural-language-to-KQL querying agent. Crest Data built a new KQL agent that lets analysts query their security data in plain English. The agent uses Anthropic’s Claude on Amazon Bedrock to translate a natural-language question into a Kusto Query Language (KQL) query, executes that query against the customer’s data, and returns the results, so analysts can interrogate their data without knowing query syntax. This added a powerful new investigative capability to the AI security analyst while reusing the platform’s existing Bedrock access layer and Converse API integration.

Credit-based usage governance (Balance Gate / AI SOC licensing). Crest Data added a new capability to enforce credit and billing limits across the AI security analyst’s chat and background workflows. Because every AI security analyst interaction ultimately drives Bedrock model calls, this “balance gate” meters AI consumption and checks it against each customer’s entitlement before expensive generative AI work runs, softly denying requests that exceed the balance. This gave the customer governance over generative AI usage and the metering foundation needed to package and license the AI security analyst’s AI SOC capabilities commercially.

Insight and chat agent accuracy improvements. Crest Data made a series of targeted improvements to the existing insight and chat agents so that the AI security analyst’s answers more faithfully reflect both the analyst asking and the data being queried. The agents were given context of the current user, so first-person questions such as “which insights are assigned to me” or “what permissions do I have” now resolve against the signed-in analyst’s real identity instead of returning generic or incorrect results. Crest Data added user name and assignee resolution that translates analyst names and emails into the correct internal identities before a query runs, with disambiguation when more than one person matches; this also repaired combined queries that filter on several conditions at once—for example, insights of a given severity assigned to a specific analyst—which had previously returned empty or wrong results. Related work tightened the grounding of insight summaries so they more accurately reflect the underlying findings and event types they are generated from. Because these agents run on Amazon Bedrock, the improvements sharpened the precision and relevance of their reasoning while keeping the same conversational interface analysts already rely on, so analysts get more precise, better-grounded answers.

Reliability and production hardening. Crest Data hardened the pre-existing platform for scale, delivering reliability fixes across the ASTRO/AI security analyst chat experience, upgrades to newer Claude models on Bedrock, and fixes to caching and audit logging. This maintenance and hardening work improved the stability and consistency of the AI security analyst in production without disrupting its existing architecture.

Across all of this work, Crest Data built on Bedrock’s core strengths for a security product: inference runs within the customer’s AWS boundary in a pinned region, so sensitive telemetry is never sent to external model endpoints; authentication uses AWS IAM roles rather than long-lived API keys; and the Converse API’s unified interface across model families meant new capabilities and model upgrades could be added without per-model integration work or re-engineering the platform.

Technology Used

AWS Services Used: Amazon Bedrock

Amazon Bedrock powers every reasoning component of the AI security analyst platform and each of the enhancements Crest Data delivered, including the natural-language-to-KQL agent, the accuracy improvements to the insight and chat agents, and the usage governance that meters AI consumption. Orchestrated through the Converse API across multiple model families (Anthropic Claude Sonnet and Haiku, and Amazon Titan Text Embeddings for semantic caching), Bedrock enabled us to add these capabilities and upgrade to newer models entirely within the AWS boundary, with managed scalability and security and without operating model infrastructure.

Outcomes & Success Metrics

By extending the AI security analyst on its existing Amazon Bedrock foundation, Crest Data helped the customer add meaningful capabilities to the platform while improving its accuracy, governance, and reliability, without a rebuild.

The natural-language-to-KQL agent gave analysts a new, faster way to interrogate their security data, lowering the expertise barrier to investigation by letting them ask questions in plain English instead of writing queries by hand. The credit-based usage governance gave the customer control and visibility over generative AI consumption across chat and workflows, providing the metering foundation to package and commercially license the AI security analyst’s AI SOC capabilities. Accuracy improvements to the insight and chat agents made the AI security analyst’s answers more precise and better grounded in customer context, and the reliability and hardening work made the platform more stable and consistent in production.

Because every enhancement was built on Bedrock and kept inference within the AWS boundary, the customer expanded the AI security analyst’s capabilities and matured it for scale while continuing to meet the strict data-handling expectations of a security product, and while keeping human oversight on consequential decisions.

About Crest Data

Crest Data is an AI-first, cloud, and cybersecurity engineering company specializing in observability, security operations, intelligent automation, and generative AI solutions. The company helps enterprises modernize operational workflows using cloud-native platforms, AI-driven analytics, and scalable automation frameworks.

Crest Data works with enterprise organizations to design and implement solutions across cybersecurity, DevOps, cloud infrastructure, data engineering, and AI-powered operational intelligence. The company focuses on building enterprise-grade systems that improve visibility, automate repetitive workflows, and accelerate operational decision-making.

As organizations increasingly explore generative AI capabilities within security operations, Crest Data has focused on building AI-assisted investigation frameworks that support modern SOC environments and operational workflows.