Amazon Detective
Amazon Detective is a service of Amazon Web Services that supports the analysis, investigation, and identification of the root cause of security events and suspicious activities.
Key points
- Analyzes and investigates security events and suspicious activities to determine their root cause.
- Automatically collects log data from AWS resources (such as CloudTrail events, VPC Flow Logs, EKS audit logs, and Amazon GuardDuty findings) and uses machine learning, statistical analysis, and graph theory to build a linked data set — a behavior graph — for investigation. Provides up to a year of historical event data through this graph.
- Finding groups correlate related findings, entities, and evidence (such as those sharing an IAM role session or IP address) that likely stem from the same underlying activity, with an interactive visualization and a generative-AI finding group summary to speed up root-cause analysis.
- Does not detect threats, discover sensitive data, or aggregate findings on its own — it investigates findings already surfaced by Amazon GuardDuty, Amazon Macie, Amazon Inspector, or AWS Security Hub (now AWS Security Hub CSPM).
- Prerequisite — GuardDuty must already be enabled as a data source before Detective can be enabled in a region. CLF-C02 study material commonly cites a specific minimum of 48 hours of GuardDuty enablement before enabling Detective; current AWS documentation confirms GuardDuty must be a prerequisite but does not spell out an explicit minimum-hours gate on the enable action itself, so treat the 48-hour figure as the widely tested exam number rather than a verified hard technical block.
- Multi-account setup uses the AWS Organizations delegated-administrator model: the organization’s management account designates a Detective administrator account, which then centrally invites/manages member accounts and their contributed data in a single behavior graph, mirroring the delegated-admin pattern used by GuardDuty and Security Hub.
- Pricing is based on the volume of data ingested per account, per Region, per month (a per-GB, tiered pricing model), covering log sources such as CloudTrail, VPC Flow Logs, EKS audit logs, and GuardDuty/Security Hub findings; there is no separate charge to enable a log source or for data already stored in Detective. A 30-day free trial starts the first time Detective is enabled in a Region.
- Entity profiles — Detective builds behavior/context profiles for entities in the graph, such as IAM roles, EC2 instances, and IP addresses, summarizing their typical activity so investigators can spot deviations.
- Scope time — the time window an investigator sets to analyze an entity’s behavior, typically centered on a finding’s timestamp and adjustable to look further backward or forward for context.