AWS First Steps
LanguageEnglish
Security

Amazon Detective

A service that automatically collects and analyzes VPC Flow Logs, CloudTrail, and GuardDuty findings to streamline root cause investigation of security incidents

About 4 min read

Overview

Amazon Detective is a service that automatically collects log data from your AWS environment, builds a graph model, and assists with security incident investigation and root cause analysis. It integrates VPC Flow Logs, CloudTrail management events, GuardDuty findings, and EKS audit logs for unified analysis, visualizing relationships between IP addresses, IAM principals, and AWS accounts. Machine learning-based baseline analysis detects deviations from normal behavior patterns and helps prioritize investigations.

Revolutionizing Security Investigation with Graph Models

Traditional security investigations required querying CloudTrail logs with Athena, separately analyzing VPC Flow Logs, and manually correlating them with GuardDuty findings. Detective automatically ingests these data sources and builds a graph database of relationships between entities (IP addresses, IAM users, roles, EC2 instances, etc.). For example, investigations like "Which EC2 instance performed AssumeRole for the IAM role that made suspicious API calls?" and "What IP addresses was that instance communicating with?" can be executed intuitively as graph traversals. Data ingestion and analysis are fully automated, requiring no user-written queries or index design. Detective retains up to 12 months of data, enabling correlation analysis with historical events. Microsoft Sentinel provides a similar security analytics platform.

Investigation Workflow from GuardDuty Findings

One usage pattern for Detective is deep-dive investigation of security threats detected by GuardDuty. Selecting a finding in the GuardDuty console and clicking "Investigate in Detective" navigates directly to the related entity's profile page. The profile page displays the entity's historical API call patterns, network traffic volume, and geographic access source distribution in timelines and graphs. Investigation results can be displayed as Finding Groups that aggregate related findings, indicating that multiple findings may be related to the same security incident.

Multi-Account Operations and Cost Optimization in Practice

In Organizations environments, a recommended configuration has the Detective administrator account aggregate and analyze data from member accounts. Similar to GuardDuty, you can set up a delegated administrator, enabling centralized security investigation across the entire organization from a dedicated security team account. New organization accounts become member accounts automatically only when the auto-enable setting (off by default) is turned on, and data ingestion then starts. On the cost side, Detective pricing is usage-based on ingested data volume. In environments with large VPC Flow Logs and CloudTrail data volumes, costs can increase. Optional data source packages (such as EKS audit logs) can be started or stopped at any time, while, among the core data sources, CloudTrail and VPC Flow Logs are ingested through streams independent of your existing log configurations. A 30-day free trial is provided, allowing you to verify actual data volumes and costs during the trial period before committing to production deployment. Detective also integrates with Security Hub CSPM, so you can pivot from a GuardDuty finding shown in Security Hub CSPM directly to Detective's investigation screen. GuardDuty, Security Hub CSPM, and Detective can be combined to build a detection, prioritization, and investigation security operations flow.

References (Official AWS Resources)

The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.

If this page and the official documentation disagree, treat the official documentation as authoritative.

Share

Related Terms

Amazon GuardDutyAWS Security HubAWS CloudTrailAmazon VPCAWS Organizations

Related Services

Amazon GuardDutyAWS Security HubAWS CloudTrailAmazon VPC

Related Articles

API Audit Logging with AWS CloudTrail - Trail Design and Security AnalysisRecord all API activity and run advanced analysis with SQL queries in CloudTrail Lake. This article covers automatic anomaly detection with Insights and real-time detection through EventBridge integration.CloudTrail Sees Everything - How API Calls Are Recorded and Practical Forensic InvestigationThis article explains how CloudTrail records AWS API calls, the differences between management events and data events, SQL analysis with CloudTrail Lake, and forensic investigation techniques when a security incident occurs.Data Privacy Protection - Automated Sensitive Data Discovery and Threat Defense with Amazon Macie and GuardDutyLearn practical data privacy protection techniques combining Amazon Macie's automated sensitive data discovery in S3 with Amazon GuardDuty's threat intelligence. This article covers comprehensive security measures from identifying personal information to real-time threat detection.Investigating Security Incidents with Amazon Detective - Root Cause Identification Through Graph AnalysisLearn about investigating GuardDuty findings with Detective, entity profiles, and leveraging behavior graphs.Threat Detection with Amazon GuardDuty - ML-Based Anomaly Detection and Incident ResponseLearn how GuardDuty detects threats, classifies findings, and integrates with Security Hub for incident response.

Similar Terms and Articles

Investigating Security Incidents with Amazon Detective - Root Cause Identification Through Graph AnalysisLearn about investigating GuardDuty findings with Detective, entity profiles, and leveraging behavior graphs.Security Investigation and Threat Analysis - Streamlining Incident Response with Amazon DetectiveLearn how to use Amazon Detective for security incident investigation and threat analysis. This guide covers the detection-to-investigation workflow with GuardDuty integration and root cause identification through graph-based analysis.Amazon DetectiveA service that automatically analyzes security findings and investigates root causesAWS Incident Response Toolchain - An Integrated Investigation Platform from CloudTrail to Security HubExplore the AWS incident response toolchain combining CloudTrail, Config, Detective, and Security Hub, and compare the investigation approach with Azure Sentinel.Threat Detection with Amazon GuardDuty - ML-Based Anomaly Detection and Incident ResponseLearn how GuardDuty detects threats, classifies findings, and integrates with Security Hub for incident response.