Defender Impact
AI agents operating without structured observability are effectively a black box to security teams — actions are taken, tools are invoked, and data is accessed with no reliable audit trail. AWS’s release of agentic observability via Amazon OpenSearch Service MCP Apps provides a native, queryable telemetry layer specifically designed for agentic workflows, closing one of the most persistent blind spots in enterprise AI deployments today.
Capability Overview
Amazon OpenSearch Service MCP Apps introduces observability tooling built around the Model Context Protocol (MCP), an emerging standard for how AI agents communicate context and invoke tools. The capability appears to provide structured logging of agent interactions — capturing tool invocations, context passed between agent steps, and the decision traces that link a user prompt to a sequence of downstream actions.
By routing this telemetry through OpenSearch, defenders gain a familiar, high-performance query and analytics layer over agent behaviour. OpenSearch’s existing strengths in log aggregation, anomaly detection, and dashboard visualisation are now extended to the agentic surface — meaning teams who already operate OpenSearch for infrastructure and application monitoring can onboard agent telemetry without standing up a separate toolchain.
The MCP integration is particularly significant. As MCP gains traction as a standard for agent-tool communication across AWS Bedrock and third-party agent frameworks, a telemetry layer built natively on MCP events positions this capability to scale across heterogeneous agent deployments rather than being confined to a single AWS-native agent runtime.
Defensive Advances
Audit trail for agent tool invocations. For the first time on AWS, defenders can query a structured record of which tools an agent called, in what order, with what arguments, and what was returned — the foundation for both incident investigation and proactive detection rule development.
Behavioural baselining for agentic pipelines. With queryable telemetry, security teams can establish normal operating patterns for specific agent workflows and define alerts on deviations — unexpected data source access, unusually long tool chains, or calls to credential-adjacent APIs that fall outside expected scope.
Post-incident forensics capability. Previously, reconstructing what an AI agent did during a security incident required piecing together fragmented application logs. Centralised agent observability through OpenSearch provides a coherent forensic timeline, materially improving mean time to understand (MTTU) after an anomalous agent event.
Correlation with broader SIEM pipelines. Because the telemetry lands in OpenSearch, it can be forwarded into existing SIEM tooling alongside infrastructure and identity logs, enabling defenders to correlate agent behaviour with network, IAM, and data access events in a unified investigation context.
Residual Gaps
The value of this capability is directly proportional to the completeness of what gets logged — and that depends on how thoroughly MCP instrumentation is implemented across the agent frameworks an organisation uses. Agents built outside AWS-native tooling may require custom instrumentation to emit MCP-compatible telemetry, and coverage will be uneven in early adoption.
Detection rule libraries for agentic telemetry are immature across the industry. Teams adopting this capability will initially need to write bespoke detection logic rather than importing proven rule sets, which requires both operational investment and a period of baseline learning before alerts become reliable.
The capability does not appear to address agent identity or authorisation verification — observability tells you what happened, not whether the agent was legitimately authorised to do it. Complementary controls around agent identity, least-privilege tool scoping, and runtime policy enforcement remain necessary and are not substituted by telemetry alone.
Framework Mapping
This capability most directly supports defender visibility against AML.T0086 (Exfiltration via AI Agent Tool Invocation) and AML.T0080 (AI Agent Context Poisoning) by creating a record of tool calls and context flows that would surface anomalous exfiltration patterns or unexpected context injection. It also aids detection of AML.T0098 (AI Agent Tool Credential Harvesting) by making credential-adjacent tool invocations visible and queryable. Against OWASP LLM Top 10, this most directly reduces blind spots associated with LLM08 (Excessive Agency) and LLM06 (Sensitive Information Disclosure).
Deployment Considerations
Organisations should prioritise enabling agent telemetry on agentic workflows with the broadest tool access first — those with access to data stores, external APIs, or IAM-adjacent capabilities represent the highest-value monitoring surface. Teams should expect a 4–8 week baseline period before anomaly thresholds are meaningfully tunable. Existing OpenSearch deployments can be extended incrementally; net-new OpenSearch deployments should be scoped alongside SIEM integration from day one to avoid duplicate pipelines.
Defender Checklist
- Inventory all production agentic workloads on AWS and identify which use MCP-compatible frameworks
- Enable OpenSearch MCP App telemetry collection for highest-risk agent pipelines first
- Define a logging schema that captures: tool name, arguments, response, agent step sequence, and invoking identity
- Establish baseline alert rules for anomalous tool invocation patterns (unexpected data access, credential API calls, unusually long chains)
- Configure OpenSearch telemetry forwarding to your SIEM for cross-surface correlation
- Review and scope agent tool permissions in parallel — observability surfaces gaps but does not enforce least privilege
- Document agent forensic runbooks using the new telemetry structure before an incident requires them