Does this replace our SIEM or SOAR?

No. Agents read findings from the SIEM and security tools you already run and hand containment steps to your SOAR. Your detections and playbooks stay where they are.

What access does it need?

Read-only access to the finding sources, logs and identity data you choose. Access is scoped per source and you can revoke it at any time.

Can agents contain a threat on their own?

Only where your policy allows it. Most teams start with agents triaging and proposing, then let them run low-risk containment such as disabling a key once the verdicts have earned trust.

How do analysts check a verdict?

Every verdict links to the exact events, logs and identity records it came from. If the evidence is thin, the report says so instead of guessing.

AWS Partner

SOC 2 Reports

Frontier Investigationfor Security Operations

The intelligence layer on top of your SIEM and SOAR: every finding triaged with evidence.

Keep your SIEM and SOAR. Agents sit on top of them, pick up every finding, pull the CloudTrail events, identity history and network flows behind it, and hand your analysts a verdict with the evidence attached. False positives are closed with a written reason. Confirmed threats arrive with a containment step ready to approve.

Book a Demo See how it works

Amazon GuardDuty findingthreat confirmed

Unusual API calls from IAM role ci-deployer

Signals: 312 ListBuckets calls from a new ASN in 6 minutes
Identity: Access key AKIA…7QX last rotated 214 days ago
Verdict: Leaked CI credential used outside the pipeline
Evidence: 9 CloudTrail events, 2 VPC flow logs
Contain: Deactivate the key, scope the role to the CI runner

Triaged in 2m 10s. Waiting for SOC approval

[The work behind every finding]

Your SIEM sees everything.Your analysts can’t read it all.

01The manual work

Triage

A finding is only a lead. Analysts still pivot across consoles, pull logs, check the identity and decide if it is real.

02The agent handoff

Verdict ready

Frontier agents enrich every finding, rebuild the attack path and prepare a verdict and a containment step for review.

03Your analysts’ role

Decide

Set which findings agents may close and which actions need sign-off. Review the evidence and approve the response.

[Where CloudThinker fits]

Your stack stays.Agents work inside it.

01Security signals

Already in your clouds

Amazon GuardDutyThreat findings across accounts
Microsoft Defender for CloudAlerts across subscriptions
Security Command CenterFindings across projects
CrowdStrikeEndpoint detections
OktaSign-in and identity events

No change to collection

02SIEM and SOAR

Your system of record

SplunkCorrelation searches and notables
ElasticsearchSecurity indices and rules
WazuhDecoders, rules and agents
SOAR platformPlaybooks you already run

System of record

03Investigation

CloudThinker

Follow the evidenceRead-only queries around each finding
EnrichAsset owner, identity and change history
VerdictTrue positive or closed with a reason
ContainIsolation steps held for approval

Read-only by default

04Response

Cases, not alerts

SlackVerdict posted to the SOC channel
Microsoft TeamsApprove containment from the thread
JiraCase with the evidence attached
PagerDutyPage only when it is real

Playbooks run on approval

Logos show common stacks. CloudThinker sits on top of your SIEM and SOAR through read-only access you approve.

[Example scenario]

Saturday, 03:47. GuardDuty fires.Your SOC has one analyst on shift.

A fintech with 14 AWS accounts, Splunk as SIEM and a SOAR running playbooks. 1,200 findings a week, one analyst overnight, a regulator who wants every incident explained.

03:47
Finding lands in the queueSignal
GuardDuty: unusual API calls from IAM role ci-deployer. Splunk raises it as one of 41 open alerts.
03:47
Agent takes it firstAgent
Pulls CloudTrail for the role, the access key history, VPC flow logs and the last CI runs that used the key.
03:49
Verdict, with evidenceAgent
312 ListBuckets calls from a new ASN, no CI run at that time, key 214 days old. Verdict: leaked credential.
03:49
Containment readyAgent
Proposes deactivating the key and scoping the role to the CI runner. Posts to the SOC channel and pages the analyst.
03:53
Analyst approvesYour team
Checks the CloudTrail events in the case, approves containment. The SOAR playbook runs under that approval.
04:05
Case written upAgent
Key disabled, no further calls. Case closed in Splunk with a timeline, evidence and a ticket to rotate CI secrets.

#soc-triage4 messages

Splunk03:47
Notable: GuardDuty UnauthorizedAccess:IAMUser/AnomalousBehavior on role ci-deployer (prod-core).
CloudThinker03:49
Verdict: threat confirmed. Key AKIA…7QX used from AS 209605 with no matching CI run. 312 ListBuckets calls, no writes yet. Proposed: deactivate key, scope role to runner. Evidence: 11 events.
SOC analyst03:53
Confirmed, no CI job at that time. Approved.
CloudThinker04:05
Key deactivated, 0 calls since 03:54. Case SEC-3307 closed with timeline. Follow-up: rotate CI secrets (SEC-3308).

from finding to contained threat: 6 min
other alerts triaged in the same hour: 40
decision asked of the analyst: 1

An illustrative example. Team, systems and times are representative, not a specific customer.

[Frontier investigation agents]

Every finding gets investigated.Only real threats reach an analyst.

Agents work as the intelligence layer between detection and response. Your SIEM keeps detecting, your SOAR keeps executing, and every finding arrives already investigated with a verdict you can check.

Enrich every finding: CloudTrail, identity, network and endpoint context pulled in the moment a finding lands.
Rebuild the attack path: Related events across accounts and tools stitched into one timeline of what the actor touched.
Close false positives: Benign findings closed with a written reason. Noisy detections flagged so your team can tune them.
Prepare the response: Confirmed threats come with a containment step your SOAR can run once an analyst approves.

[What changes]

Same team. Same tools.Far less of the work by hand.

Moment	Today	With frontier agents
First look at a finding	Whenever an analyst reaches it in the queue	Minutes after it lands
Enrichment	By hand, console by console	Identity, log and network context pulled automatically
False positives	Closed without a record of why	Closed with a written, auditable reason
Response	Playbooks started by hand	Containment step ready for approval
Detection quality	Tuned when someone has time	Noisy rules flagged from every investigation

[Integrations]

Connects to the rest of your stack.Read-only to start.

Splunk
Sumo Logic
Elasticsearch
Amazon GuardDuty
AWS Security Hub
AWS CloudTrail
CrowdStrike
SentinelOne
Microsoft Defender
Wiz
Okta
PagerDuty
ServiceNow
Slack

[Adoption path]

One pilot.Then company-wide.

The rollout follows the four phases of the AWS Cloud Adoption Framework, so it fits the plan your cloud team already runs.

01Envision
Pick one finding source
Connect one SIEM or GuardDuty feed read-only and let agents triage in shadow mode. Compare their verdicts with your analysts’.
02Align
Agree the response policy
Decide which findings agents may close alone, which containment steps need approval, and who approves.
03Launch
Roll out across accounts
Add every account and detection source on the same policies, verdict format and audit trail.
04Scale
Make it the SOC default
Every new detection launches with agent triage on. Verdicts feed rule tuning and incident reviews.

[AWS guidance]

Built the way AWS says to run it.Reviews start from a known reference.

[Trust and control]

Agents do the work.Your team keeps control.

You approve every change: Agents propose. Nothing touches production until someone on your team says yes, and you set that rule per system.
Every action on the record: Each step is logged, attributed and reversible, ready for your auditors.
Certified for enterprise: SOC 2 Type II and ISO 42001, with reports in our trust center.
Runs where you need it: In our cloud, through AWS Marketplace, or inside your own account.

[Questions]

What teams askbefore they start.

Does this replace our SIEM or SOAR?: No. Agents read findings from the SIEM and security tools you already run and hand containment steps to your SOAR. Your detections and playbooks stay where they are.
What access does it need?: Read-only access to the finding sources, logs and identity data you choose. Access is scoped per source and you can revoke it at any time.
Can agents contain a threat on their own?: Only where your policy allows it. Most teams start with agents triaging and proposing, then let them run low-risk containment such as disabling a key once the verdicts have earned trust.
How do analysts check a verdict?: Every verdict links to the exact events, logs and identity records it came from. If the evidence is thin, the report says so instead of guessing.

[Go deeper]