CyberArk combines Apache Iceberg and Amazon Bedrock AI agents to cut support case resolution time up to 95%

Overview

CyberArk redesigned its technical support pipeline using AWS Fargate, PyIceberg and Amazon Bedrock (Claude 3.7 Sonnet) to auto-generate grok patterns for parsing diverse vendor log formats into Iceberg tables, and built autonomous AI agents that query Athena and CyberArk's knowledge base to perform root-cause analysis from natural-language questions. The system cut case resolution time by up to 95% (complex cases from up to 15 days to 2-4 hours), let engineers handle up to 4x more cases per day (from 2-3 to 8-12), and made logs queryable within minutes instead of hours or days.

The challenge

When a support engineer received a new case, the biggest bottleneck was preparing data: customer logs arrived in different formats from multiple vendors requiring manual integration and correlation, AWS Glue crawlers ran as asynchronous batch jobs introducing delays of minutes to hours, and investigations required engineers to manually query data, correlate events and search documentation, taking hours or days.

The solution

CyberArk built single-stage serverless log processing where AWS Fargate with PyIceberg directly creates Iceberg tables from raw logs, used Amazon Bedrock (Claude 3.7 Sonnet) to automatically generate and validate grok patterns for parsing diverse log formats, stored validated patterns in DynamoDB for reuse, and deployed autonomous AI agents that query Athena and CyberArk's knowledge base to perform flow identification, root-cause determination and solution recommendation from natural-language questions.

Reported business value

CyberArk achieved up to a 95% reduction in case resolution time, with simple cases dropping from 4-6 hours to 15-30 minutes and complex cases from up to 15 days to 2-4 hours; support engineers now handle 8-12 cases per day versus 2-3 before, up to 4x more customers helped per engineer, and logs became queryable within minutes instead of hours or days.