AWS DevOps Agent + Wiz: Same Alert, Three Different Incidents
Cloud Platform EngineeringA CPU spike on an EC2 instance could mean a bad deploy is looping, traffic scaled past capacity, or a cryptominer is running on a compromised host. To an on-call engineer staring at CloudWatch, those three situations look identical at the alert layer. The engineer has to manually pivot into a separate security tool, if one exists, to tell them apart — and that pivot rarely happens during the first ten minutes of triage, which is exactly when it matters most.
AWS DevOps Agent and Wiz have closed that gap by wiring security context directly into the investigation loop, rather than leaving it as a separate step an engineer has to remember to take.
How It Works
The integration runs over Model Context Protocol (MCP), the standardized way agents call external tools. When AWS DevOps Agent identifies the resources involved in an alert, it automatically queries Wiz’s remote MCP endpoint (https://mcp.app.wiz.io/?toolset=devops) as part of the same investigation pass — no separate trigger, no engineer copy-pasting an instance ID into a different console. As the post puts it: “The security query happens alongside the operational investigation, not after it.”
The agent sends only resource identifiers over that call, not operational telemetry. Wiz answers from its Security Graph using a specific tool set: list_cloud_resources to confirm the resource is even covered, list_findings for a unified view of vulnerabilities, misconfigurations, exposed secrets, and data risk, list_vulnerability_findings for CVE-level detail including exploitability against the CISA Known Exploited Vulnerabilities catalog, list_issues for prioritized “toxic combinations” of risk, list_threats and list_malware_findings for active compromise signals, and get_green_agent_analysis for AI-generated remediation steps. If the Wiz endpoint is unreachable or times out, the agent doesn’t stall — it finishes the investigation on operational data alone and flags the missing security context in its findings.
What This Means for You
That combination changes what “triage” produces. The same CPU spike alert now resolves into one of three distinct outcomes instead of one ambiguous one: no findings, so it’s an operational issue — proceed with the deployment or scaling investigation as usual. A validated, exploitable, internet-exposed vulnerability, which reclassifies the alert as an active security incident and routes it to isolation and the security team instead of the SRE runbook. Or the resource simply isn’t in Wiz’s coverage, which surfaces as its own actionable finding: a gap to close, not a false negative to shrug off.
AWS’s demo walks through that middle case directly — a reported CPU spike that the agent traces, via the Wiz query, to “a critical, internet-exposed Remote Code Execution (RCE) under active exploitation,” turning what looked like a routine scaling alert into a confirmed breach in the same pass that would otherwise have ended with an engineer bumping an autoscaling group. Getting that classification right at minute five instead of hour two is the entire value proposition: AWS frames the broader DevOps Agent effort around cutting the manual correlation work that otherwise consumes an on-call engineer’s first hours on an incident, and a misrouted “operational” ticket that’s actually an active RCE is the most expensive version of that delay.
The So What
The durable idea here isn’t “AWS integrated with a security vendor.” It’s that investigation and security context stopped being sequential steps performed by different people with different tools, and became one query inside one workflow. An alert no longer arrives context-free and gets classified later, possibly by someone without security tooling open — it arrives already carrying an answer to “is this dangerous,” sourced from whichever posture tool actually holds that data. As more DevOps agents adopt this same MCP-mediated pattern with other posture and identity tools, the meaningful skill for platform teams shifts from “which dashboard do I check next” to “which context sources does my agent’s Agent Space actually have wired in” — because that wiring, not the alert itself, now determines whether an incident gets classified correctly in the first five minutes.
Source: AWS DevOps Blog
Content created with AI assistance and reviewed for accuracy.
Join the conversation
Stack Insiders is our free community for readers who want to go deeper — share resources, ask questions, and connect with others across every vertical we cover.
Join Stack Insiders →