How Detective Builds a Behavior Graph

Detection tells you something is wrong; investigation tells you what actually happened. Amazon Detective is the service built for investigation. It automatically analyzes activity and builds a visual model so you can understand the full story behind a finding, not just the alert.

Detective continuously ingests and links log data to build a graph of behavior over time. Instead of manually correlating logs across services, you get a pre-built, queryable picture of how entities like accounts, instances, and IP addresses have interacted.

The core construct is the behavior graph: nodes are entities (such as IAM roles, EC2 instances, IP addresses, and accounts) and edges are the interactions and activity between them. The graph captures normal baselines and deviations, giving investigators a map rather than raw logs.

Detective builds its graph from the same kinds of telemetry as detection: CloudTrail management events, VPC Flow Logs, and GuardDuty findings, plus EKS audit logs. It does the heavy correlation automatically, so you do not assemble these sources by hand.

Like GuardDuty, Detective is agentless and fully managed. You enable it and it pulls the data it needs; you do not build log pipelines or storage. It also retains roughly a year of linked activity, giving long lookback for investigations without you managing retention.

Detective uses machine learning and statistics to learn what is normal for each entity, then highlights deviations. Knowing the baseline lets an investigator see that, say, an instance suddenly made far more API calls than usual, which is a strong signal of compromise.

The graph is presented as interactive visualizations: timelines, profiles for each entity, and activity charts. An analyst clicks through related entities to follow a trail. This visual approach turns hours of log grepping into guided exploration.

A key distinction: GuardDuty detects, Detective investigates. GuardDuty raises a finding; Detective helps you determine its scope, root cause, and impact. They are complementary, and the exam expects you to pick Detective when the need is investigation and root-cause analysis.

Detective integrates with AWS Organizations and supports a delegated administrator, so a security account can investigate activity across all member accounts in one behavior graph. This mirrors GuardDuty and Security Hub for consistent multi-account operations.

Detective retains roughly a year of linked activity in the behavior graph, far longer than GuardDuty's default finding retention. This long lookback lets investigators see whether suspicious behavior began weeks ago, revealing slow, stealthy intrusions that a short window would miss. The extended history is a key reason Detective complements rather than duplicates detection.

A practical detail: Detective requires GuardDuty to have been enabled for a period (around 48 hours) before you can enable Detective. This is because Detective uses GuardDuty findings and the same underlying telemetry to seed its behavior graph. The two services are designed to work hand in hand, with detection feeding investigation.

Distinguish detection from investigation.

Detective is the agentless, managed investigation service. It links CloudTrail, VPC Flow Logs, GuardDuty findings, and EKS audit logs into a behavior graph of entities and interactions, baselines normal behavior, and presents interactive visualizations with about a year of lookback. GuardDuty detects; Detective investigates root cause and scope.