Amazon Detective
- What it is
- Security investigation service. Automatically builds a linked graph of events, resources, and behavior over time.
- Answers “what actually happened, and how far did it spread?” after a finding is raised.
- Data sources
- AWS CloudTrail, VPC Flow Logs, Amazon GuardDuty findings, EKS audit logs.
- Retains up to a year of aggregated behavior for baselining.
- The workflow it fits into
- GuardDuty detects → AWS Security Hub aggregates and prioritizes → Detective investigates root cause.
- Not to be confused with
- GuardDuty — raises the alert. Detective does not detect; it explains.