Amazon Detective

Amazon Detective analyzes log data to identify the root cause of security findings and suspicious activity. It automatically collects log data from CloudTrail, VPC Flow Logs, GuardDuty findings, and EKS audit logs. Where GuardDuty answers "something suspicious happened", Detective answers the questions that follow: what else did that principal touch, is this traffic pattern actually new, and which of these fifty findings belong to the same incident.

How It Works

• Builds a behavior graph from up to 12 months of historical data
• Uses machine learning, statistical analysis, and graph theory to link related findings
• Visualizes resource interactions, API call patterns, and network connections

Investigation Features

• Finding Groups: automatically groups related GuardDuty findings into potential security incidents
• Entity Profiles: detailed timelines for IP addresses, IAM principals, EC2 instances
• Investigation Summaries: AI-generated narratives explaining unusual behavior

Integration

• One-click pivot from GuardDuty or Security Hub findings to Detective
• Multi-account support via Organizations
• No log management or ETL required - automatic ingestion

What Detective Replaces in a Real Investigation

Without Detective, answering "what did this compromised role do over the last month" means writing Athena queries against CloudTrail logs in S3, joining them by hand with VPC Flow Logs, and building your own timeline. That work is entirely doable and many teams keep the Athena path as a complement, but it is slow at 2am. Detective pre-computes the joins: pick an IAM role, an access key, or an IP address and you get its full activity profile, with volumes compared against the baseline of what that entity normally does. The baseline part matters most, since the difference between "this instance talks to this IP every day" and "this started on Tuesday" is usually the whole investigation.

How It Goes Wrong in Practice

The recurring mistake is treating Detective as a tool you can switch on mid-incident. Detective starts collecting log data when you enable it, and its comparisons of recent activity rely on historical baselines that AWS states are established after about two weeks of monitoring. Enable it the day you discover a breach and you get an empty graph with no history and no baselines, precisely when you needed a year of context. The "up to 12 months" figure describes how much data Detective retains once it is running, not a backfill it performs for you. The operational conclusion is blunt: Detective is a preparation control, like CloudTrail itself. Enable it across the organization during peacetime, let it accumulate history, and it will pay for itself in the first serious investigation. The second common gap is enabling it only in the administrator account, forgetting that member accounts must be associated to appear in the behavior graph at all.

A Practical Check: Confirming the Behavior Graph Exists

To verify Detective is actually enabled and your account administers a behavior graph in the current Region:

aws detective list-graphs

The response lists the behavior graph ARNs with their creation time. An account can currently administer only one behavior graph per Region, so a healthy setup returns exactly one entry per active Region, and the CreatedTime tells you how much history you really have. An empty list in a Region where you run workloads means investigations there will start from zero.

Frequently Asked Questions

What is the difference between GuardDuty and Detective?

GuardDuty is detection: it analyzes telemetry and emits findings when something looks malicious. Detective is investigation: it organizes a year of activity data into a graph so an analyst can scope, triage, and find the root cause behind those findings. GuardDuty tells you the alarm went off; Detective helps you reconstruct who walked through which doors.

How is Detective priced, and can I try it?

Pricing is per gigabyte of data ingested per account, per Region, per month, on a tiered scale starting at 2 USD per GB for the first 1,000 GB and decreasing at higher volumes. There is a 30-day free trial with the full feature set, during which you can see projected costs for your actual data volume before committing.

Does Detective work across multiple accounts?

Yes. Through AWS Organizations you designate a delegated administrator whose behavior graph aggregates data from member accounts, so an investigation can follow an attacker pivoting between accounts in one place. Members must be enabled in the graph; accounts that were never associated contribute nothing.

Do I need GuardDuty to use Detective?

Detective can be used without GuardDuty enabled, but in practice the pairing is the point: GuardDuty findings are both a primary data source and the usual entry point for a Detective investigation via the console pivot.