Engagement Overview
Arnica builds application-security software for development teams. The Tactical Edge engagement focused on connecting security events, application context, and remediation workflows within an AWS architecture.
The Challenge
- Bring findings from different scanning and development workflows into a consistent processing path.
- Help reviewers understand a finding's application context before choosing a remediation.
- Connect model-assisted recommendations to existing developer workflows with traceable decisions.
The Approach
- Use event-driven processing to connect incoming security findings with the application's existing services.
- Organize approved security context for retrieval alongside each finding.
- Keep remediation recommendations, reviewer decisions, and execution boundaries visible to operators.
What Changed
The engagement connected security-event processing, contextual analysis, and remediation workflows around the existing product. Each proposed fix still needs validation against the affected application.
AWS Agentic AI Capability Extension
The following architecture describes capabilities that could extend this engagement's workflow. It distinguishes possible additions from the original customer work.
A new vulnerability finding could trigger retrieval of the affected component, approved remediation guidance, and relevant application context. An agent could prepare a proposed fix and a review summary linked to that evidence.
| Service | Role in the extension |
|---|---|
| Amazon Bedrock | Explain a finding and draft remediation guidance from the supplied application context. |
| Bedrock Knowledge Bases | Retrieve approved security guidance and repository documentation with source references. |
| AgentCore Runtime and Gateway | Read finding details, prepare an issue, or open a proposed change through narrowly scoped tools. |
| AWS workflow services | Route security events with EventBridge and Lambda, and retain workflow state and review decisions in Step Functions or the application's control plane. |
AgentCore can host an application's agent and expose approved tools through Gateway, with Identity for service access and Observability for execution traces. The application defines its tool permissions, validation, and approval steps.[1]
Bedrock Knowledge Bases can retrieve relevant source material and include citations in generated responses. Select the retrieval configuration and apply the source content's access rules before supplying it to a model.[2]
Existing Amazon Bedrock Agents deployments can use action groups and knowledge bases for orchestration. AWS now calls this service Bedrock Agents Classic and has closed it to new customers; new agent implementations should evaluate AgentCore.[3]
Bedrock Guardrails offers configurable content, sensitive-information, and grounding checks. Test the selected checks against representative requests and keep authorization and human approvals in the application workflow.[4]
Operating Boundaries and Evaluation
Repository permissions, code review, automated tests, and the deployment process remain authoritative. A generated recommendation does not authorize a code merge or production change.
Measure finding relevance, recommendation accuracy, reviewer acceptance, time to a reviewed fix, and any regressions introduced by accepted changes.
AWS References
These references document the extension's AWS capabilities.
- Amazon Bedrock AgentCore overview. https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/what-is-bedrock-agentcore.html
- Amazon Bedrock Knowledge Bases. https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base.html
- Amazon Bedrock Agents Classic. https://docs.aws.amazon.com/bedrock/latest/userguide/agents.html
- Amazon Bedrock Guardrails. https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html