Detective

1. Amazon Detective helps analyze and investigate security findings and suspicious activity.

2. Automatically collects log data from AWS services like CloudTrail, VPC Flow Logs, and GuardDuty.

3. Builds visualizations of user and resource behavior over time.

4. Provides graph-based investigations to identify the root cause of incidents.

5. Fully automated data ingestion and correlation—no manual setup needed.

6. Supports deep dive into API activity, login attempts, and network traffic.

7. Retains data for up to 1 year for historical analysis.

8. Integrated natively with Amazon GuardDuty and AWS Security Hub.

9. Does not generate findings, but helps analyze and contextualize existing ones.

10. Automatically groups related events and entities into profiles.

11. No agent installation required—data is sourced from AWS service logs.

12. Supports investigation of IAM roles, EC2 instances, IP addresses, and accounts.

13. Useful for forensics, incident response, and threat hunting.

14. Supports multi-account investigations using AWS Organizations.

15. Visual UI in the console helps security teams trace actions and dependencies.