Orca Security deployed Discovery AI for natural language queries in Sonar
Discovery AI on Amazon Bedrock converts questions into security queries in Sonar. According to AWS, the deployment reduced query costs by 90 % and response times from approximately 60 to 15 seconds compared with the original prototype.
Orca Security worked with AWS to build and deploy Discovery AI on Amazon Bedrock. The tool converts natural language questions into queries in Sonar, which includes more than 900 models of cloud resources and applications. Manually constructing a query required knowing the exact model names and their relationships, and choosing from 18 operators.
The solution combines RAG with schema-guided query construction. It uses Amazon Titan embeddings to retrieve the 20 closest examples, and Cohere Rerank 3.5 selects the five most relevant ones. The Model Selector component uses Claude Haiku 4.5 from Anthropic to select the data models needed. The generator then receives their complete schemas and associated relationships, so it does not have to process the entire Sonar schema for every request.
According to AWS, the deployed solution processes thousands of queries a day. Compared with the original prototype, which included the entire schema in a single prompt, query costs fell by 90 %, the number of input tokens by 93 % and response times from approximately 60 to 15 seconds. The reported results apply to this specific deployment and the original prototype used as the baseline.
Why it matters
The case study shows a specific way to make a complex security data system accessible through questions in everyday language. For the design of similar interfaces, it demonstrates the importance of selecting relevant examples and limiting the schema passed to the generator; the reported savings cannot automatically be transferred to other deployments.
Two audiences, two different impacts
What this means
For individuals
A security analyst can use Discovery AI to ask a question without manually constructing a query or knowing the exact names of the data models in Sonar.
For a business
According to AWS, Orca Security reduced the operating costs of its security query interface and shortened response times while processing thousands of queries a day.
ProcessesCheck the original
Event sources
only one source so far · 1 publisher, 0 independent. We count feeds from the same owner only once.