Pivoting from a GuardDuty Finding

Investigations usually begin with an alert. Detective integrates tightly with GuardDuty so you can pivot directly from a finding into the behavior graph. One click takes you from "something is wrong" to a rich, contextual view of everything related to that finding.

In GuardDuty and Security Hub, findings carry an Investigate in Detective action. Choosing it opens Detective focused on the entities in that finding, such as the affected instance, the IAM role, or the remote IP. The context comes preloaded, saving setup time.