Amazon Detective

Amazon Detective is the investigation tool that follows a detection. Where GuardDuty says something is wrong, Detective answers what happened, in what order, and how far did it reach.

Detective collects log data from AWS resources automatically and uses machine learning, statistical analysis and graph theory to build a behaviour graph: a linked model of accounts, roles, users, instances, IP addresses and findings, with up to a year of historical activity behind it. Because the graph is built continuously, the history is already there when an investigation starts.

Data sources

• AWS CloudTrail management events
• Amazon VPC Flow Logs
• Amazon GuardDuty findings
• Amazon EKS audit logs

Detective also integrates with Amazon Security Lake, which allows raw CloudTrail management events, VPC Flow Logs and EKS audit logs held in the lake to be queried from the Detective console.

What it is used for

Triaging findings. Determine the severity and scope of a finding quickly, distinguish a false positive from a real one, and trace the sequence of events that led to the alert. Detective’s finding groups collect the several findings and unusual behaviours that a single intrusion typically produces and present them as one incident with an interactive visualisation, rather than as unrelated alerts.

Threat hunting. Examine how a principal or resource has behaved over time against its own baseline, follow a suspicious IP address through its interactions with the estate, and look for lateral movement. Detective Investigation analyses IAM users and roles against indicators of compromise and returns the resources involved.

Network flow analysis. Overall VPC flow volume shows the traffic between an EC2 instance or Kubernetes pod and the addresses it talked to over a chosen window, which is often the fastest way to confirm or rule out exfiltration.

Multi-account use

The account that enables Detective becomes the administrator of a behaviour graph and invites member accounts to contribute their data. With AWS Organizations, the management account designates a Detective administrator for the organisation, which then enables organisation accounts as members. From a GuardDuty or Security Hub CSPM finding, a console link pivots straight into the corresponding entity in Detective.