Incident management · Production

Palo Alto Networks automated log classification with Amazon Bedrock achieves 95% precision and 83% reduction in debugging time

The problem

Palo Alto Networks' Device Security team could only react to production issues after they emerged, as processing over 200 million daily log entries reactively caused delayed response times and risk of service degradation.

First attempt

Traditional rule-based systems struggled to handle evolving log patterns and required system modifications when new log categories emerged.

Workflow diagram · grounded in source
1
Log ingestion trigger
trigger
“Incoming logs from Palo Alto Networks' FluentD and Kafka pipeline are immediately processed through an Aurora based caching layer”
2
Smart caching and deduplication
ai_action
“The system first applies exact matching, then falls back to overlap similarity, and finally uses semantic similarity through Amazon Titan Text Embeddings if no earlier match is found. During testing, this approach identified that more th…”
3
Context retrieval for unique logs
ai_action
“the system uses Amazon Titan Text Embeddings to identify the most relevant historical examples from Palo Alto Networks' labeled dataset. Rather than using static examples, this dynamic retrieval makes sure each log receives contextually …”
4
Severity classification with Claude Haiku
ai_action
“Unique logs and their selected examples are processed by Amazon Bedrock using Anthropic's Claude Haiku model. The model analyzes the log content alongside relevant historical examples to produce severity classifications (P1, P2, P3) and …”
5
Results stored and pipeline integration
integration
“Results are stored in Aurora and the cache and integrated into Palo Alto Networks' existing data pipeline for SME review and action”
6
SME review and validation
human_review
“SMEs responding to critical alerts require confidence in AI recommendations, particularly for P1 severity classifications. By providing detailed reasoning alongside each classification, Palo Alto Networks enables SMEs to quickly validate…”
7
Validated examples feed back to retrieval
feedback_loop
“Each validated classification becomes part of the dynamic few-shot retrieval dataset, improving accuracy for similar future logs while increasing cache hit rates”
Reported outcome

The automated pipeline achieved 95% precision and 90% recall for P1 severity logs, reduced debugging time by 83%, and processes 200 million daily logs with over 99% cache hit rate, transforming reactive monitoring into proactive issue detection.

Reported metrics
P1 severity detection precision95%
P1 severity recall90%
Incident response time reduction83%
Debugging time reduction83%
Show all 7 reported metrics
P1 severity detection precision95%
P1 severity recall90%
incident response time reduction83%
debugging time reduction83%
cache hit rateover 99%
log deduplication rateover 99%
daily log volume processed200 million
Reported stack
Amazon BedrockClaude HaikuAmazon Titan Text EmbeddingsAmazon Aurora
Source
https://aws.amazon.com/blogs/machine-learning/how-palo-alto-networks-enhanced-device-security-infra-log-analysis-with-amazon-bedrock?tag=soumet-20
Read source ↗

Frequently asked questions

What did this team achieve with this AI workflow?

The automated pipeline achieved 95% precision and 90% recall for P1 severity logs, reduced debugging time by 83%, and processes 200 million daily logs with over 99% cache hit rate, transforming reactive monitoring int…

What tools did this team use?

Amazon Bedrock, Claude Haiku, Amazon Titan Text Embeddings, Amazon Aurora.

What results were reported?

P1 severity detection precision: 95%; P1 severity recall: 90%; Incident response time reduction: 83%; Debugging time reduction: 83% (source-reported, not independently verified).

What failed first in this deployment?

Traditional rule-based systems struggled to handle evolving log patterns and required system modifications when new log categories emerged.

How is this incident management AI workflow structured?

Log ingestion trigger → Smart caching and deduplication → Context retrieval for unique logs → Severity classification with Claude Haiku → Results stored and pipeline integration → SME review and validation → Validated examples feed back to retrieval.

Related incident management cases