Amazon Detective
Amazon Detective
Amazon Detective API automatically analyzes AWS logs (VPC Flow Logs, CloudTrail, GuardDuty) for security investigations — visualizes attack chains.
Auto-ingests multiple AWS log types into a graph
Requires GuardDuty enabled first
EnableOrganizationAdminAccount (if using Organizations) → CreateGraph. Detective begins auto-ingesting logs.
Uptime · 30-day window
GitHub activity
About this API
Detective is AWS's security investigation tool. After a security alert (GuardDuty says "this IAM role is behaving anomalously"), the next step is SOC investigation — what happened, where did the attacker enter, which resources were affected, what operations did the user perform. Traditional approach: manually search CloudTrail, VPC Flow Logs, sift through raw logs. Detective auto-ingests these logs into a graph database, correlating: "this IAM role was called 200 times by this IP in the past hour, accessing these S3 buckets, downloading these objects". Visualizes everything — investigation time drops from hours to minutes. Relationships: GuardDuty discovers, Security Hub aggregates, Detective investigates.
What you can build
- 1Investigate incidents after GuardDuty alerts
- 2Audit anomalous user behavior
- 3Lateral movement analysis after intrusion
- 4Forensic investigations for compliance
Strengths & limitations
Strengths
- Auto-ingests multiple AWS log types into a graph
- ML-based anomaly baseline detection
- Visualizes attack chains, saving investigation time
Limitations
- Requires GuardDuty enabled first
- Charged by ingested data volume — costly for large accounts
Getting started
EnableOrganizationAdminAccount (if using Organizations) → CreateGraph. Detective begins auto-ingesting logs.
FAQ
Does Detective require GuardDuty to be enabled first?+
Yes. Detective is designed to work with GuardDuty and cannot currently be used standalone.
Technical details
- Auth type
- unknown
- Pricing
- unknown
- Protocols
- REST
- SDKs
- python, javascript, go, java, csharp
- Response time
- 43 ms
- Last health check
- 6/26/2026, 6:22:15 AM
More from Amazon Web Services
AWS IAM Access Analyzer API analyzes IAM resource policies for over-privileged access or external access — proactively surfaces security risks.
Alexa for Business helps you use Alexa in your organization.
Amazon API Gateway helps developers deliver robust, secure, and scalable mobile and web application back ends.
Use AppConfig, a capability of Amazon Web Services Systems Manager, to create, manage, and quickly deploy application configurations.
Welcome to the Amazon AppFlow API reference.
The Amazon AppIntegrations service enables you to configure and reuse connections to external applications.
Amazon AppStream 2.0 API Reference.
Amazon Athena is an interactive query service that lets you use standard SQL to analyze data directly in Amazon S3.