Amazon Detective

Amazon Detective is a managed security investigation service that ingests and correlates AWS telemetry to help analysts explore and determine the root cause of suspicious activity. It operates by building an interactive behavior graph and timelines from supported data sources to surface related entities and events. It typically sits alongside detection services and security operations tools to provide contextual analysis for alerts and findings.

🗂 Resource Category

Security, Identity, and Compliance • Management and Governance

🧠 Exam Memory Hook

Think: "Security alerts + investigation timeline + entity graph = Amazon Detective"

📖 Ownership

Classification: AWS Managed Service

AWS responsibilities: AWS operates and maintains the Amazon Detective control plane, managed data ingestion and processing pipelines, storage and graph-building infrastructure, console and APIs, and is responsible for patching and securing the underlying service platform and physical infrastructure.

Customer responsibilities: The customer configures and enables Detective, links accounts when multi-account investigation is required, grants IAM permissions, ensures telemetry sources (for example AWS CloudTrail, VPC Flow Logs, and Amazon GuardDuty) are enabled and accessible, reviews investigations, and implements remediation or automation via separate tools.

Patching responsibilities: AWS patches and maintains the physical infrastructure, managed runtime, operating system, and service platform used by Amazon Detective; the customer is responsible for patching guest operating systems, applications, libraries, dependencies, and any software running on their own EC2 instances or other compute resources that generate telemetry.

🏗 Typical Architecture

💡 Top 5 Features

Ingests supported telemetry and security findings when enabled to centralize investigation data.
Builds an interactive entity relationship graph linking resources, identities, IPs, and events for root-cause analysis.
Provides timelines and contextual summaries that surface historical activity and behaviour changes for entities.
Offers console and API investigation tools to pivot between related entities, events, and findings.
Supports investigations across linked accounts when configured with organization or delegated account features.

✅ Top 5 Use Cases

Triage and investigate Amazon GuardDuty findings by expanding related entities and historical events to identify root cause.
Perform forensic analysis of suspicious API calls using CloudTrail event timelines and related resource activity.
Analyze lateral movement and network relationships using VPC Flow Logs correlated with resource and identity activity.
Conduct multi-account investigations by linking member accounts to examine cross-account activity and relationships.
Provide contextual evidence for security incident reports and to guide remediation decisions executed by other tools.

🏗 Architecture Placement

Amazon Detective is a regional, account-level security analysis service that ingests telemetry from supported AWS sources such as CloudTrail, VPC Flow Logs, and GuardDuty. Detection services and telemetry producers send data to Detective (when enabled) and security analysts query Detective for investigations. It integrates into security operations workflows and can be enabled across member accounts in an AWS Organization when configured. Detective is intended for investigation and analysis rather than prevention or automated remediation.

🎯 Commonly Used With

- Amazon GuardDuty
- AWS CloudTrail
- Amazon VPC
- AWS CloudWatch Logs
- AWS Security Hub

🌍 5 Real-World Examples

A financial services security team investigates unusual console logins flagged by GuardDuty using timelines and entity links to determine if credentials were compromised.
A healthcare organization traces access to a sensitive data store by reviewing CloudTrail events and related network flows to confirm whether PHI was accessed inappropriately.
A retail security operations team uses Detective to correlate VPC Flow Logs and resource activity to investigate suspected lateral movement after a compromised instance alert.
A telecommunications operator examines historical activity for an IP address and linked resources to validate whether outbound traffic patterns indicate data exfiltration.
A government security team pivots from aggregated findings to detailed timelines and entity relationships to support an internal incident response workflow.

🎓 AWS Exam Clues

Choose Detective when you need interactive relationship graphs and timelines for investigation rather than prevention.
Detective is commonly used together with GuardDuty for investigating prioritized alerts and Security Hub for aggregated findings.
Enabling multi-account investigations requires account linking or organization-level configuration and appropriate IAM permissions.
Detective builds and queries a behavior graph from ingested telemetry; it does not automatically remediate findings.
Operational considerations include ensuring required telemetry sources are enabled and granting the service access to those logs.

📝 Quick Revision

Amazon Detective builds a behavior graph and timelines from supported telemetry to help security teams investigate suspicious activity and GuardDuty findings. Use it when you need interactive root-cause analysis across entities and accounts; consider telemetry availability, IAM permissions, and that remediation must be performed by other tools.

🏷 Keywords

entity graph • behavior graph • investigation timeline • GuardDuty integration • CloudTrail ingestion • VPC Flow Logs ingestion • multi-account investigations • delegated administrator • security triage • visual investigation • console investigations • API investigations