Amazon Detective
Security investigation service that builds a behavior graph from your logs so you can trace a finding back to its root cause.
Verified against AWS documentation · 2026-08-26
Key facts
- 01Answers "what happened and why" AFTER a finding exists — GuardDuty detects, Detective investigates
- 02Auto-ingests CloudTrail, VPC Flow Logs, EKS audit logs, GuardDuty findings, and Security Hub findings — no pipelines, no queries to write
- 03Uses ML, statistical analysis, and graph theory to build a behavior graph linking accounts, resources, and IP addresses over time
- 04Retains up to 1 year of aggregated data for analysis
- 05Prerequisite: GuardDuty must be enabled at least 48 hours before enabling Detective
Exam triggers
Phrases and scenarios that point here.
- "Root cause analysis" of a security finding → Detective
- "Investigate" or "analyze" suspicious activity across accounts and time → Detective
- "Visualize relationships" between resources, users, and IPs during an incident → behavior graph
- Detect vs. investigate distinction: GuardDuty raises the alarm, Detective works the case
Not this service
- Detecting threats in the first place → GuardDuty
- Aggregating findings and compliance posture in one dashboard → Security Hub
- Scanning EC2/containers for software vulnerabilities → Inspector
- Finding sensitive data in S3 → Macie
Use cases
- 01An engineer's access key shows up in a GuardDuty finding — Detective's behavior graph shows every API call, resource touched, and IP involved, so you know if it was a leaked key or the engineer on hotel Wi-Fi
- 02Tracing a compromised EC2 instance backwards: which role launched it, what it talked to, and whether the traffic pattern is new or normal for that instance
- 03Post-incident scoping across an AWS Organization — one behavior graph over member accounts instead of grepping CloudTrail in each one
- 04Deciding if a spike in failed logins is an attack or a misconfigured cron job, by comparing against up to a year of baseline behavior
How it's charged
- 01Priced per GB of data ingested, per account, per Region, per month — the more log volume you generate, the more you pay
- 02Tiered flat rate regardless of source: price per GB drops as monthly volume climbs past 1,000 GB
- 03No charge for enabling the log sources, for data storage, or for running investigations — ingestion is the only meter
- 04Billing lands on the account that generated the logs, not the delegated admin account doing the analysis
- 0530-day free trial with projected-cost visibility, so you can see the real bill before committing
