1. What is Detective?

Amazon Detective makes it easy to analyze, investigate, and identify the root cause of security findings or suspicious activities. It automatically collects log data and uses machine learning, statistical analysis, and graph theory to build a linked set of data for investigations.

Core Concept
Detective = security investigation tool. GuardDuty DETECTS threats. Detective INVESTIGATES them. When GuardDuty says "suspicious API call from IP 1.2.3.4," Detective helps you answer: Who is 1.2.3.4? What else did they do? Which resources were affected? When did this start? What was the scope of the compromise?

2. How Detective Works

  1. Automatically ingests data from: CloudTrail, VPC Flow Logs, GuardDuty findings, EKS audit logs
  2. Builds a behavior graph: maps relationships between users, IPs, resources, and API calls over time
  3. Retains up to 12 months of data for historical investigation
  4. Provides visualizations: timelines, geolocation maps, resource activity graphs
  5. One-click investigation from GuardDuty findings or Security Hub

3. Investigation Workflow

Security Investigation Flow:

1. GuardDuty detects: "UnauthorizedAccess:IAMUser/MaliciousIPCaller"
2. Security team opens a Detective from the GuardDuty finding
3. Detective shows:
   - Full timeline of all API calls from that IP
   - All IAM entities that used those credentials
   - All resources accessed or modified
   - Geolocation of the IP address
   - Historical baseline vs current behavior
4. Team determines: scope, blast radius, root cause
5. Team remediates: rotate credentials, isolate resources


4. Key Features

  1. Behavior graph: automatically links entities (IPs, users, resources, API calls)
  2. No manual log collection: ingests automatically from integrated sources
  3. Historical data: up to 12 months for deep investigation
  4. Multi-account via Organizations (delegated administrator)
  5. Integrates with: GuardDuty, Security Hub (investigate findings directly)
  6. Pay per volume of data ingested into the behavior graph

5. Security Services Workflow

Complete AWS Security Services Workflow:

1. PREVENT:    IAM, KMS, WAF, Shield, Network Firewall, SGs, NACLs
2. DETECT:     GuardDuty (threats), Inspector (vulnerabilities), Macie (sensitive data)
3. AGGREGATE:  Security Hub (single dashboard, compliance checks)
4. INVESTIGATE: Detective (root cause analysis, scope determination)
5. AUTOMATE:   EventBridge → Lambda/SSM (remediation)
6. AUDIT:      CloudTrail (API logs), AWS Config (resource config history)


Exam Tip
Detective: "Investigate security findings" = Detective. "Root cause analysis" = Detective. "What else did the attacker do?" = Detective. Detective does NOT detect threats (that’s GuardDuty). Detective INVESTIGATES what GuardDuty found. Uses behavior graphs. 12-month data retention. Integrates with GuardDuty + Security Hub.