Spotting Anomalous Activity Patterns

The payoff of investigation is recognizing patterns that signal a compromise. Detective surfaces these, but you must know what they look like. This lesson covers the anomalous patterns that most often mean an attacker is at work in an AWS environment.

A sudden spike in API calls from an entity that is normally quiet is a classic red flag. Attackers enumerate resources and make many calls quickly. Detective's baseline comparison makes such spikes obvious against the entity's normal rhythm.