Amazon Detective
Investigating security findings and suspicious activity: automatic collection of CloudTrail, VPC Flow Logs, EKS audit logs, and GuardDuty and Security Hub findings into a behavior graph, visualizations of up to a year of history, root-cause analysis, how it fits with GuardDuty and Security Hub, and pricing.
2 min read · Last reviewed · SAA-C03
Sign in to bookmark tutorials and track what you have read.
On this page
What it is
Amazon Detective helps you analyze, investigate, and quickly identify the root cause of security findings or suspicious activity. It automatically collects log data from your AWS resources and uses ML (Machine learning)Software that learns patterns from example data to make predictions or decisions, instead of following rules written by hand. A model is first trained on data, then used to make predictions on new data, which is called inference.Glossary entry, statistical analysis, and graph theory to build visualizations, so security analysts can see what happened, which resources and identities were involved, and how far an issue spread. It gives access to up to a year of historical event data.
Choose Detective when a question asks how to investigate a GuardDuty finding or find the root cause of suspicious activity, without manually collecting and joining logs.
How it works
- Data sources:
- AWS CloudTrail logs.
- VPC Flow Logs.
- Amazon EKS audit logs.
- Amazon GuardDuty findings.
- Findings that integrated services send to AWS Security Hub.
- Detective organizes the data into a behavior graph that links entities such as IP (Internet Protocol)The protocol that addresses and routes packets between networks. Each device has an IP address: IPv4 addresses look like 192.0.2.1, and IPv6 addresses are longer, like 2001:db8::1.Glossary entry addresses, IAM roles, users, and EC2 instances.
- Visualizations show changes in the type and volume of activity over time and link them to GuardDuty findings, so you can triage whether a finding is a true positive and scope the impact.
Detective, GuardDuty, or Security Hub?
| Question asks | Choose |
|---|---|
| Is something malicious happening? | Amazon GuardDuty (detection) |
| What is our overall security posture, and where are all the findings? | AWS Security Hub (aggregation and posture) |
| What exactly happened, and what is the root cause? | Amazon Detective (investigation) |
Security and cost
- Detective needs no agents or log setup of its own; it uses data from the services above.
- Cost: per GB of data ingested per account, AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry, and month, after a 30-day free trial.
Reverse mindmap: when the question points here
- Yes, when the question says
- Investigate the root cause of a GuardDuty finding leads to Detective
- Visualize activity of an IP or role over time leads to Detective behavior graph
- Scope a potential compromise quickly leads to Detective
- No, when the question says
- Detect threats leads to GuardDuty
- Aggregate findings and check standards leads to Security Hub
- Find vulnerabilities leads to Inspector
Key takeaways
- Detective investigates findings and suspicious activity and helps find the root cause.
- It builds a behavior graph from CloudTrail, VPC Flow Logs, EKS audit logs, and GuardDuty and Security Hub findings, with up to a year of history.
- GuardDuty detects, Security Hub aggregates, and Detective investigates.
- It is priced per GB ingested, with a 30-day free trial.