Amazon Detective Specialized2019年〜
A service that automatically analyzes security findings and investigates root causes
What It Does
Amazon Detective is a service for investigating and analyzing the root causes of security incidents in your AWS environment. It automatically collects and integrates data from VPC Flow Logs, CloudTrail logs, and GuardDuty findings to build a graph database. Security analysts can quickly understand the relationships and impact of suspicious activities through visual dashboards.
Use Cases
It is used for detailed investigation of suspicious API calls detected by GuardDuty, analysis of abnormal behavior patterns of IAM users and roles, and tracking suspicious communications from EC2 instances. It is especially effective when you need to quickly determine 'who did what, and when' during a security incident to prioritize your response.
Everyday Analogy
Think of it like an investigation board in a detective show. When a case (security incident) occurs, Detective automatically gathers related evidence (log data) and creates a relationship map (resource connections). The investigator (security analyst) can trace the suspect's (attacker's) actions chronologically by looking at the board.
What Is Detective?
Amazon Detective is a service that assists with security incident investigations. AWS environments generate massive volumes of logs every day, and manually investigating these logs when a security issue occurs is extremely time-consuming. Detective automatically collects and analyzes log data, presenting it in a visually intuitive format to dramatically reduce investigation time.
Data Sources and Analysis
Detective automatically ingests CloudTrail management events, VPC Flow Logs, GuardDuty findings, and EKS audit logs. It integrates this data into a graph database and builds relationships between resources. For example, you can visualize which EC2 instances an IAM user accessed and which IP addresses those instances communicated with, all as a connected flow.
Integration with GuardDuty
Detective works closely with GuardDuty. When GuardDuty detects a threat, you can investigate the finding in detail with a single click in Detective. If GuardDuty reports 'suspicious API call detected,' Detective lets you examine the activity before and after that API call, related resources, and how the behavior differs from normal patterns. For a deeper understanding of GuardDuty integration, reference books (Amazon) are also helpful.
Getting Started
To get started with Detective, simply enable it in the Detective console. GuardDuty must be enabled first. Once activated, ingestion of historical log data begins automatically. It takes a few hours for data to accumulate, but once complete, you can select findings or resources to begin your investigation.
Things to Watch Out For
- GuardDuty must be enabled before activating Detective, as GuardDuty findings are a primary data source for Detective
- Pricing is based on the volume of log data ingested, so estimate costs in advance for large-scale environments
- Detective is an investigation and analysis tool - threat detection is handled by GuardDuty, and response automation by Security Hub. Using all three services together is most effective
