AWS Detective
Amazon Detective uses ML and graph theory to help conduct faster security investigations across AWS workloads.
What is Detective? (Simple Explanation)
Detective is an AWS service in the Security category. Amazon Detective uses ML and graph theory to help conduct faster security investigations across AWS workloads.
When Would You Use Detective?
- Security incident investigation
- Root cause analysis of GuardDuty findings
- IAM role behavior analysis
- Lateral movement detection
Who Uses Detective?
From startups to enterprises, Detective powers:
What Makes Detective Powerful
Detective Pricing & Free Tier
Core security services (IAM, KMS, CloudTrail, Shield Standard) are always free. Advanced features (GuardDuty, WAF, Shield Advanced) have per-usage pricing.
Detective Best Practices
- 1Enable MFA on all IAM users and root account
- 2Never use root account for daily tasks — create IAM users with least privilege
- 3Enable CloudTrail across all regions with log file validation
- 4Rotate access keys every 90 days and never commit them to source control
- 5Use IAM roles for EC2/Lambda/ECS instead of long-term access keys
Getting Started with Detective in 5 Minutes
- 1Open the AWS Console and navigate to Detective
- 2Review the default settings — most security services are pre-configured with best-practice defaults
- 3Define your policies, rules, or detection scope based on your environment
- 4Enable logging to CloudTrail and set up alerts to SNS for critical findings
Detective CLI Quick Reference
2 production-ready commands. Full CLI Library (225+ services) →
aws detective helpView all Detective CLI v2 commands and subcommandsaws detective describe-detective --helpView options for describing Detective resourcesPros & Cons of Detective
Pros
- Unified view across GuardDuty, CloudTrail, VPC Flow Logs
- Graph-based entity relationship visualization
- Automatic data aggregation
- Up to 12 months of historical analysis
- Integration with Security Hub
Cons
- ✕Proper IAM policy design has a steep learning curve — overly permissive policies are common
- ✕Root account is a single point of failure if MFA is lost
- ✕CloudTrail logs can become expensive at scale without lifecycle management
Detective vs Alternatives
Detective vs GuardDuty
Choose Detective for Security incident investigation and Root cause analysis of GuardDuty findings. It excels at unified view across guardduty, cloudtrail, vpc flow logs.
Choose GuardDuty as an alternative when your requirements differ. Each service in the Security category serves different architectural patterns.
Services That Work with Detective
Detective is rarely used alone. It is typically combined with:
Compliance & Security
How AWS Detective fits into major compliance standards. Browse all 41 frameworks →
Detective configuration is audited by CIS Benchmarks v1.5–v3.0 for secure cloud defaults.
NIST 800-53Detective access controls, encryption, and audit logging map to NIST 800-53 AC, SC, and AU control families.
PCI DSS 4.0Detective encryption, access control, and logging support PCI DSS for cardholder data environments.
SOC 2Detective security, availability, and confidentiality controls evaluated under SOC 2 Trust Services Criteria.
ISO 27001Detective configuration and monitoring controls map to ISO 27001 Annex A information security management.
Frequently Asked Questions About Detective
What is AWS Detective?
Amazon Detective uses ML and graph theory to help conduct faster security investigations across AWS workloads.
What is Detective used for?
Detective is commonly used for: Security incident investigation; Root cause analysis of GuardDuty findings; IAM role behavior analysis; Lateral movement detection. It's a core service in the security category of AWS.
Is Detective free?
Core security services (IAM, KMS, CloudTrail, Shield Standard) are always free. Advanced features (GuardDuty, WAF, Shield Advanced) have per-usage pricing.
What are the key features of Detective?
Detective's most important capabilities include: Unified view across GuardDuty, CloudTrail, VPC Flow Logs. Graph-based entity relationship visualization. Automatic data aggregation. Up to 12 months of historical analysis. Integration with Security Hub. Each of these is designed to help teams security incident investigation.
How does Detective compare to alternatives?
Detective competes with both AWS-native alternatives (GuardDuty, CloudTrail, VPC Flow Logs) and third-party equivalents. The right choice depends on your specific requirements for scalability, cost, and operational overhead. See the comparisons section below for detailed guidance.
Which compliance frameworks apply to Detective?
CIS AWS v3.0: Detective configuration is audited by CIS Benchmarks v1.5–v3.0 for secure cloud defaults. NIST 800-53: Detective access controls, encryption, and audit logging map to NIST 800-53 AC, SC, and AU control families. PCI DSS 4.0: Detective encryption, access control, and logging support PCI DSS for cardholder data environments. SOC 2: Detective security, availability, and confidentiality controls evaluated under SOC 2 Trust Services Criteria. ISO 27001: Detective configuration and monitoring controls map to ISO 27001 Annex A information security management.
People also search for
Was this page helpful?
Ready to secure your Detective configuration?
Pavora continuously monitors your AWS Detective for misconfigurations, compliance violations, and security risks.