Amazon Detective
Amazon Detective
Amazon Detective API automatically analyzes AWS logs (VPC Flow Logs, CloudTrail, GuardDuty) for security investigations — visualizes attack chains.
Auto-ingests multiple AWS log types into a graph
Requires GuardDuty enabled first
EnableOrganizationAdminAccount (if using Organizations) → CreateGraph. Detective begins auto-ingesting logs.
Uptime · 30-day window
GitHub activity
About this API
Detective is AWS's security investigation tool. After a security alert (GuardDuty says "this IAM role is behaving anomalously"), the next step is SOC investigation — what happened, where did the attacker enter, which resources were affected, what operations did the user perform. Traditional approach: manually search CloudTrail, VPC Flow Logs, sift through raw logs. Detective auto-ingests these logs into a graph database, correlating: "this IAM role was called 200 times by this IP in the past hour, accessing these S3 buckets, downloading these objects". Visualizes everything — investigation time drops from hours to minutes. Relationships: GuardDuty discovers, Security Hub aggregates, Detective investigates.
What you can build
- 1Investigate incidents after GuardDuty alerts
- 2Audit anomalous user behavior
- 3Lateral movement analysis after intrusion
- 4Forensic investigations for compliance
Strengths & limitations
Strengths
- Auto-ingests multiple AWS log types into a graph
- ML-based anomaly baseline detection
- Visualizes attack chains, saving investigation time
Limitations
- Requires GuardDuty enabled first
- Charged by ingested data volume — costly for large accounts
Example request
curl https://github.com/mermade/aws2openapi/<endpoint>Getting started
EnableOrganizationAdminAccount (if using Organizations) → CreateGraph. Detective begins auto-ingesting logs.
FAQ
Does Detective require GuardDuty to be enabled first?+
Yes. Detective is designed to work with GuardDuty and cannot currently be used standalone.
Technical details
- Auth type
- unknown
- Pricing
- unknown
- Protocols
- REST
- SDKs
- python, javascript, go, java, csharp
- Response time
- 17 ms
- Last health check
- 5/12/2026, 7:36:33 AM
More from Amazon Web Services
AWS IAM Access Analyzer API analyzes IAM resource policies for over-privileged access or external access — proactively surfaces security risks.
Amazon Chime SDK API embeds real-time audio/video calling and chat into apps (meetings, messaging, PSTN calls).
Amazon CloudFront is the AWS CDN and edge service — accelerates static and dynamic content delivery, a standard for web performance.
Amazon CloudSearch is AWS's managed search service (gradually superseded by OpenSearch Service).
CloudWatch Application Insights API auto-detects application problems — intelligently identifies anomalies (slow SQL queries, memory leaks), reducing manual alarm configuration.
AWS Cognito Identity Pools API issues temporary AWS credentials to frontend apps — identity federation, guest users, direct AWS resource access.
Amazon Cognito User Pools deliver managed user signup, login, password reset, and MFA for applications.
Amazon Connect Contact Lens API uses AI to analyze Amazon Connect calls in real time — sentiment, keywords, compliance detection, auto-summary.