Amazon Detective

Amazon Detective is a fully managed security analytics and investigation service engineered to simplify and accelerate the process of investigating potential security issues, abnormal behavior, and suspicious activity across Amazon Web Services environments. Security analysts often face difficult investigations involving massive volumes of fragmented log data; Amazon Detective solves this challenge by automatically ingesting, parsing, and organizing telemetry into an interactive, visual graph model that reveals resource interactions and behavioral baselines over time.

The platform ingests security findings and activity logs from foundational AWS sources, including AWS CloudTrail, Amazon VPC Flow Logs, Amazon GuardDuty, and Amazon EKS audit logs. Detective uses machine learning, statistical modeling, and graph analytics to construct a comprehensive behavior graph that maps relationships between IP addresses, user accounts, AWS IAM roles, EC2 instances, and container resources. Analysts can visually explore security findings in context, identifying root causes, evaluating whether an anomaly represents an isolated event or part of a coordinated attack sequence, and reviewing historical activity patterns up to a year. Detective also features generative AI summaries to explain complex security incidents in plain language.

Primary enterprise use cases include security incident triage, root cause analysis, compromised credential investigations, malware outbreak tracing, and security operations center productivity enhancement. By transforming vast security log datasets into intuitive visual graphs, Amazon Detective empowers security teams to conduct thorough investigations rapidly and remediate cloud threats effectively.