Amazon Detective
#117 · Level 3 · Modern architecture · SecurityConcept
Section titled “Concept”Amazon Detective helps investigate security events. It automatically collects data such as CloudTrail logs, VPC Flow Logs and GuardDuty findings. From this data it builds a behavior graph, which shows the relationships between users, IPs and resources, and their behavior over time. This makes it easier to understand where a suspicious event started and how far it spread. GuardDuty raises the alarm, and Detective helps you investigate deeper into that alarm.
Simple example
Section titled “Simple example”A detective — they put together different clues (CCTV, registers, witnesses) to find out what really happened.
Why it’s needed
Section titled “Why it’s needed”When GuardDuty shows something suspicious, you need an investigation to understand what happened and how far it spread.
Where it’s used
Section titled “Where it’s used”After a suspicious event, finding out which users and which resources were involved.
Azure equivalent
Section titled “Azure equivalent”Microsoft Sentinel (investigation)
Learn more
Section titled “Learn more”For details and the latest information, see the official documentation: