Analyze AWS Session Manager transcripts with AI while preserving source logs, identity context, synthetic tests, analyst review and realistic cost controls.

Why administrator transcripts are a useful AI workload

AWS published a reference implementation on October 13 that analyzes completed Systems Manager Session Manager transcripts with Amazon Bedrock, stores structured summaries, alerts on sessions labeled suspicious or critical, and lets analysts query session history through Amazon Bedrock AgentCore.

The architecture is relevant because command meaning depends on sequence, output, identity and operational context. A single administrative command may be routine during a documented maintenance window and concerning when paired with unexpected identity or network activity. That makes transcript review a better fit for evidence-assisted triage than autonomous enforcement.

This topic uses older context within the requested 30-day window because the AWS post includes a deployable sample and test steps. A focused Firecrawl search on October 28 returned the AWS article as the leading result plus AWS News indexing and public implementation discussion. That indicates continued attention, not independent validation, adoption, traffic or ranking.

A session transcript moves through identity context and structured summarization into an analyst-owned review queue.
Preserve the source object and context before an AI summary enters the case queue.

1. Build a protected evidence pipeline

AWS's sample uses Session Manager logging, an S3 transcript event, Lambda, CloudTrail context, a Bedrock model, DynamoDB summaries, SNS alerts and an AgentCore query harness. Its prerequisites include a configured managed node, deployment permissions and access to a supported Bedrock model. The sample's default model ID is only an example; verify regional availability before deployment.

Use separate nonproduction resources for the pilot. Encrypt transcripts and summaries, restrict the S3, CloudWatch and DynamoDB paths, set retention deliberately and log every read. Treat command output as potentially sensitive because it can contain identifiers, paths, configuration values or secrets.

Preserve a stable session ID, object version or digest, IAM principal, source address, start and end time, managed-node identifier and change ticket. The summary must point back to those records. If the transcript is incomplete or identity enrichment fails, mark the case incomplete rather than asking the model to infer the missing data.

Completed cloud administrator transcripts enter a protected analysis chamber and emerge as locked evidence packets for review.
AI-generated conceptual illustration: the evidence pipeline protects raw transcripts and separates them from summaries.
  • Keep source transcripts immutable and access-controlled.
  • Store summaries separately from the authoritative evidence.
  • Record every enrichment failure as an observable state.

2. Require the model to cite the session sequence

Ask for a bounded schema: classification, confidence band, cited transcript ranges, identity facts, relevant sequence, benign explanations, missing context and recommended analyst checks. Do not accept an alert that contains only a severity and prose rationale.

Example prompt: 'Classify this completed administrative session using the supplied policy. Cite the exact ordered events supporting and contradicting the label. Separate observed transcript content from CloudTrail identity facts and from inference. If source lines or context are missing, return unresolved. Recommend read-only verification steps; do not contain, revoke or modify anything.'

Keep deterministic detections alongside the model. Known disallowed actions, unexpected identities, session starts outside approved windows and logging failures should remain explicit rules. The model can add sequence context, but it should not be the only path that raises or suppresses a case.

An evidence ladder challenges the model label with source transcript lines, identity and time context, then assigns an analyst state.
A classification becomes actionable only after it is tied to reproducible source evidence.

3. Test with synthetic, labeled fixtures

Create sanitized transcript fixtures for routine maintenance, an approved but unusual sequence, a known policy violation and an ambiguous session with missing context. Use a disposable account and harmless commands; do not run destructive actions merely to test the detector.

For each fixture, record the expected evidence, not just the expected label. A useful test checks whether the system cites the correct sequence, preserves identity facts, recognizes approved context and refuses to invent output. Repeat the set after prompt, model, policy or enrichment changes.

Track false alerts, missed fixtures, unresolved sessions, citation errors, latency, transcript and model cost, and analyst review time. The AWS post describes expected sample behavior but is not a benchmark. Local acceptance criteria should be set before viewing the pilot results.

A four-part test set includes normal, ambiguous, alert and negative-control session fixtures.
Labeled fixtures test evidence quality and refusal behavior, not just whether a label appears.

4. Make the analyst own the case state

A reviewer should open the original transcript and compare the cited sequence with CloudTrail, change records, workload telemetry and the user's role. The analyst may confirm the finding, mark it benign, keep it unresolved or escalate it for containment. Preserve the reason and cited evidence for that decision.

Natural-language history queries are useful for locating related sessions, but a generated answer should return stable session references and query boundaries. Re-run important searches through a deterministic CloudWatch Logs Insights or database query and attach the result to the case.

Do not automatically disable a principal or terminate workloads from a model classification. If emergency containment is required, use the organization's documented playbook and an independently authorized operator. Missing or delayed transcripts also need an alert because silence is not proof of normal activity.

Two SOC analysts compare an anomaly label with source transcript, identity records and a maintenance window.
AI-generated conceptual illustration: analysts challenge the label against the underlying evidence and operational context.

5. Control privacy, retention and cost

The sample creates metered AWS resources across Bedrock, Lambda, S3, DynamoDB, CloudWatch, SNS and AgentCore. Prices, regional support and quotas vary. Estimate transcript volume and token use with sanitized historical data, set budgets and alarms, and delete the nonproduction stack after the pilot if it is no longer needed.

Minimize transcript content before model processing where possible, but do not redact so aggressively that the sequence becomes misleading. Decide which employees and administrators are notified, how long source and summary records are retained, and which legal, HR or labor requirements apply to session monitoring.

Restrict prompt changes, model changes and detection-policy changes through code review. Log version identifiers with each classification so a reviewer can reproduce the conditions that produced it. A later model answer is not a replacement for the original decision record.

An analyst handoff records the session identifier, evidence sources, supported finding and next action.
Every escalation keeps a stable source reference, evidence boundary and accountable next step.

6. End the pilot with a go, change or stop decision

Promote only if transcripts arrive reliably, identities are enriched, citations are accurate, unresolved states remain visible and the review burden is acceptable. Require a tested rollback for the pipeline and a separate response plan for the incidents it may surface.

Stop or redesign the pilot if the model repeatedly invents commands, hides missing data, labels approved work without usable evidence, misses known fixtures or creates a secondary sensitive-data store the organization cannot govern.

DeepSecurity.io did not deploy the AWS sample or measure detection performance. The practical output of this guide is a governed transcript-review workflow and evidence-backed analyst handoff, not a claim that generative AI detects administrator abuse reliably in every environment.

Put the insight into practice.

Deep Security helps organizations assess risk, validate controls, and build a practical plan to strengthen their defenses.

Talk with Deep Security