Analyzing Entities and Time Windows

Effective investigation combines two questions: which entities were involved, and over what time did they behave oddly? Detective is built around both. Mastering how it presents entities and time windows lets you read a graph quickly and confidently.

In Detective, an entity is anything the graph tracks: an IAM user or role, an EC2 instance, an AWS account, an IP address, a user agent, or a finding itself. Each has a profile page summarizing how it behaved and what it connected to.

An entity profile gathers everything Detective knows about one entity into panels: API call volume over time, geolocations of activity, connected resources, and observed findings. It is the single page where you understand one actor or resource in depth.

Every profile is bounded by a scope time, the time window you are analyzing. You can widen or narrow it to focus on the period around an incident. Detective compares activity within that window against the entity's longer-term baseline.

Detective contrasts baseline behavior with the scoped window. If an IAM role normally makes 50 calls an hour but made 5,000 during the window, that deviation jumps out. Reading these comparisons is how you separate normal noise from genuine anomalies.

For identity findings, Detective shows the geographic locations and IPs an entity acted from. A role suddenly used from an unfamiliar country during the scope time strongly suggests stolen credentials. Location patterns are among the clearest investigative signals.

Detective breaks down the API calls an entity made: which actions, how often, and whether they are new for that entity. A burst of unusual actions like creating users or changing policies during the window points toward an active attacker, not routine use.

Each profile lists connected entities: the IPs that called a role, the instances a credential touched, the accounts involved. Following these connections within the time window reconstructs the chain of activity that makes up the incident.

Investigation is iterative: you set a scope time, find something, then adjust the window to capture more of the activity. Narrowing isolates the precise event; widening reveals earlier reconnaissance or later lateral movement. Detective makes this re-scoping fast.

Detective presents an entity's behavior as a timeline of activity over the scope time, with charts that make spikes and gaps visible at a glance. Hovering or clicking a point reveals the underlying calls or connections. Learning to read this timeline lets you pinpoint exactly when abnormal behavior started, which often marks the moment of compromise.

Detective tailors its analysis to the entity type. For an IAM role or user, it emphasizes assumed-role activity, geolocations, and API actions; for an EC2 instance, network connections and traffic volume; for Kubernetes, pod and container activity from EKS audit logs. Knowing which signals matter for each resource type sharpens how you read a profile during an incident.

Read an entity over time.

Detective analysis pairs entities (roles, users, instances, IPs, accounts) with a scope time window. Entity profiles show API call volume, geolocations, and connected entities, comparing scoped activity against a long-term baseline. Deviations like API-call spikes or activity from new locations reveal compromise, and you re-scope the window iteratively to follow the evidence.