Pivoting from a GuardDuty Finding

Investigations usually begin with an alert. Detective integrates tightly with GuardDuty so you can pivot directly from a finding into the behavior graph. One click takes you from "something is wrong" to a rich, contextual view of everything related to that finding.

In GuardDuty and Security Hub, findings carry an Investigate in Detective action. Choosing it opens Detective focused on the entities in that finding, such as the affected instance, the IAM role, or the remote IP. The context comes preloaded, saving setup time.

Pivoting drops you onto an entity profile, a page summarizing one entity's activity: its typical behavior, recent changes, and connections. From the finding's instance, for example, you immediately see its API call volume, network activity, and any anomalies.

From one entity you pivot to related entities: the IP that contacted the instance, the role whose credentials were used, or other resources the actor touched. Each pivot expands the picture, letting you trace an attacker's path through the environment step by step.

A core goal is determining blast radius: what else did the actor touch? Detective's linked graph shows whether a single instance was affected or whether credentials spread to other resources. This scoping decides how broad your containment must be.

Pivoting also helps you decide if a finding is a true positive. If the related activity matches a known, benign pattern, you can dismiss it confidently. If it reveals more suspicious behavior, you escalate. Either way you act on evidence, not guesses.

When you pivot, Detective shows activity around the finding's time window, comparing it to the entity's historical baseline. Seeing that a spike began exactly when the finding fired strengthens the case that the finding marks a real intrusion.

With organization integration, a pivot can follow activity across accounts. If a compromised credential was used in a second account, Detective can show it in the same graph. This is vital because attackers often move laterally between accounts.

By eliminating manual log correlation, pivoting compresses investigation from hours to minutes. Faster understanding means faster containment, which directly limits damage. The exam frames Detective as the accelerator between a GuardDuty alert and an effective response.

The Investigate in Detective action is not limited to GuardDuty. Security Hub findings that come from GuardDuty also offer the pivot, so an analyst triaging the aggregated dashboard can jump straight into the behavior graph. This means the central console and the investigation tool connect directly, keeping the detect-aggregate-investigate flow seamless.

Detective can cluster related findings into finding groups, automatically connecting findings, entities, and the activity that links them into one investigable unit. Instead of pivoting from a single finding, you start from a group that already tells a coordinated story. This speeds investigation by surfacing the whole incident rather than one alert at a time.

Trace the investigation workflow.

Detective integrates with GuardDuty via the Investigate in Detective action. Pivoting opens an entity profile, lets you follow related entities to scope the blast radius, compares activity to a time-aware baseline, and can follow lateral movement across accounts. This turns a finding into fast, evidence-based investigation and response.