Amazon Detective mindmap

Amazon Detective

Analyze, investigate and quickly find the root cause of security findings or suspicious activity

• Core data sources: Read directly by Detective; no logs to turn on
  • AWS CloudTrail: API activity of users and roles
  • VPC Flow Logs: Network traffic of EC2 instances
  • Amazon GuardDuty findings: Threats to investigate
• Optional source packages: Extra data you can start or stop at any time
  • EKS audit logs: Kubernetes activity in Amazon EKS clusters
  • AWS security findings: Findings sent to Security Hub CSPM by other services
• Behavior graph: Links resources, users and their interactions over time
  • Up to one year of history: Compare current activity with the baseline
  • Entity profiles: Activity, related findings and context for an IP address, role, user, instance or cluster
• Investigate: Tools to scope and triage a security event
  • Finding groups: Related findings and entities grouped into one possible security event
  • Investigations: Automated investigation of an IAM user or role, with indicators of compromise
  • MITRE ATT&CK mapping: Tactics and techniques behind a finding group
• Start from: Pivot into Detective from other services
  • Amazon GuardDuty console: Pivot from a finding
  • AWS Security Hub console: Pivot from a finding
• Multi-account management: Administrator account with up to 1,200 member accounts
  • 30-day free trial: For each account in each Region