Incident management · Production

Trellix lowers cost and increases speed with Amazon Nova Micro and Nova Lite for threat investigation

The problem

Security teams face talent and budget constraints that force them to prioritize which threats to investigate, limiting coverage of new threats. With growing adoption of Trellix Wise, the cost structure of running Claude Sonnet-based investigations at scale became a concern.

Workflow diagram · grounded in source
1
Security events ingested
trigger
“The platform uses the Amazon OpenSearch Service stores billions of security events collected from the environments monitored”
2
RAG context retrieval
ai_action
“OpenSearch Service comes with a built-in vector database capability, making it straightforward to use data stored in OpenSearch Service as context data in a Retrieval Augmented Generation (RAG) architecture with Amazon Bedrock Knowledge …”
3
Multiple Nova Micro inferences
ai_action
“The Trellix team concluded, based on their testing, Amazon Nova Micro offered two key advantages. Its speed allows it to process 3-5 inferences in the same time as a single Claude Sonnet inference and it's cost per inference is almost 10…”
4
ML analysis and risk scoring
ai_action
“analysis of the data using insights from other custom-built machine learning (ML) models, and risk scoring. This sophisticated approach enables the service to interpret complex security data patterns and make intelligent decisions about …”
5
Investigation results output
output
“The Trellix Wise investigation gives each event a risk score and allows analysts to dive deeper into the results of the analysis, to determine whether human follow-up is necessary”
6
Analyst human review
human_review
“allows analysts to dive deeper into the results of the analysis, to determine whether human follow-up is necessary”
Reported outcome

Amazon Nova Micro delivered inferences three times faster and at nearly 100-fold lower cost; by running multiple inferences, Trellix lowered investigation costs by a factor of 30 while maximizing data coverage.
The approach is now deployed in a limited pilot environment with a phased production rollout underway.

Reported metrics
Inference speed vs prior modelthree times faster
Inference cost reduction vs prior modelnearly 100-fold lower cost
Investigation cost reduction via multiple inferenceslower costs by a factor of 30
parallel inference throughput vs Claude Sonnet3-5 inferences in the same time as a single Claude Sonnet inference
Reported stack
Trellix WiseAmazon BedrockAmazon Nova MicroAmazon Nova LiteClaude SonnetAmazon OpenSearch ServiceAmazon Bedrock Knowledge Bases
Source
https://aws.amazon.com/blogs/machine-learning/trellix-lowers-cost-increases-speed-and-adds-delivery-flexibility-with-cost-effective-and-performant-amazon-nova-micro-and-amazon-nova-lite-models?tag=soumet-20
Read source ↗

Frequently asked questions

What did this team achieve with this AI workflow?

Amazon Nova Micro delivered inferences three times faster and at nearly 100-fold lower cost; by running multiple inferences, Trellix lowered investigation costs by a factor of 30 while maximizing data coverage.

What tools did this team use?

Trellix Wise, Amazon Bedrock, Amazon Nova Micro, Amazon Nova Lite, Claude Sonnet, Amazon OpenSearch Service, Amazon Bedrock Knowledge Bases.

What results were reported?

Inference speed vs prior model: three times faster; Inference cost reduction vs prior model: nearly 100-fold lower cost; Investigation cost reduction via multiple inferences: lower costs by a factor of 30; parallel inference throughput vs Claude Sonnet: 3-5 inferences in the same time as a single Claude Sonnet inference (source-reported, not independently verified).

How is this incident management AI workflow structured?

Security events ingested → RAG context retrieval → Multiple Nova Micro inferences → ML analysis and risk scoring → Investigation results output → Analyst human review.

Related incident management cases