Orca Security Uses Amazon Bedrock for Natural Language Security Queries

Problem and Solution Overview

Security analysts often require quick insights into their cloud infrastructure but may lack expertise in domain-specific query languages. Orca Security addresses this challenge by enabling natural language security queries through its Discovery AI tool, built on Amazon Bedrock. This solution allows analysts to ask questions in plain language, bypassing the need for complex syntax. Discovery AI supports queries across over 900 cloud models, including Amazon EC2 instances and Amazon S3 buckets, as tracked by Orca Security’s Sonar platform. By partnering with AWS, Orca Security has integrated Amazon Bedrock’s capabilities to process and interpret natural language inputs, providing actionable security insights. This approach enhances accessibility and efficiency for security teams, enabling them to focus on critical tasks without being hindered by technical barriers.

Technical Implementation Details

Orca Security's Discovery AI leverages Amazon Bedrock to implement a hybrid solution that integrates Retrieval Augmented Generation (RAG) with schema-aware query construction, as outlined in the solution overview (AWS Machine Learning). The system processes natural language security queries through a multi-stage pipeline, with each stage utilizing the most suitable Amazon Bedrock model to convert questions into valid Discovery filters, as described in the technical implementation details (AWS Machine Learning). Orca selected Amazon Bedrock for its ability to provide multi-model access through a single API, enabling the team to allocate different foundation models to each pipeline stage without managing separate integrations, as noted in the technical implementation details (AWS Machine Learning).

Performance and Cost Efficiency

Orca Security has achieved significant improvements in performance and cost efficiency by leveraging Amazon Bedrock for natural language security queries. According to the Orca team, their solution processes thousands of queries per day with a consistent 15-second response time (AWS Machine Learning). Cost reductions were also substantial, with overall expenses dropping by 90 percent (AWS Machine Learning). This efficiency was achieved through optimized token consumption and strategic allocation of models across different stages of processing. Additionally, the use of Amazon Titan embeddings enabled the team to implement top-20 nearest-neighbor retrieval as the most effective method for query resolution (AWS Machine Learning). These results highlight the potential of cloud-based AI services in enhancing both the speed and economic viability of security operations.

Pipeline Architecture and Components

The pipeline architecture for natural language security queries at Orca Security leverages Amazon Bedrock to transform user input into validated Discovery filter queries through a nine-step process. A key component is the Neural Relevance Reranking stage, which utilizes Cohere Rerank 3.5 on Amazon Bedrock to refine and prioritize retrieved candidates. This step enhances the accuracy of query results by reordering them based on relevance. Additionally, the Orca team benchmarked multiple retrieval strategies on Amazon Bedrock to optimize how the Generator translates questions into Sonar queries. Strong examples were found to be more effective than schema alone in teaching the Generator to produce accurate queries. These steps ensure that the pipeline remains robust and adaptable to complex security-related natural language inputs.

Sources and reporting notes

• AWS Machine Learning

Based on published source material. No independent hands-on testing is claimed.