The following entities are supported at launch: This means I often found myself switching back and forth between entity types to discover new entities via the suggestions list. Unfortunately, it seems as if the search box doesn't actually perform any sort of search, but rather expects you to enter an identifier in whatever way the service expects. You should select a type from the dropdown box which will give you some suggestions for that type of entity. Once Detective has completed its backfill, you can use the search facility to look for supported entities to begin with. Once enabled, entity data will usually become available within 24 hours. Note that the principal who accepts the member account invitation must have the detective:AcceptInvitation IAM permission. When inviting a member account, you will be given the option to specify an e-mail address and personalized invitation message to the member account owner. Detective recommends you keep it, GuardDuty and Security Hub in the same account to allow for easy pivoting to occur. Setting upĮnabling Detective works much like GuardDuty does, with a simple enable function and the ability to invite additional accounts to a master. Security services have been slowly increasing in the AWS landscape with VPC Flow Logs, Config, CloudTrail, GuardDuty, Security Hub and many other points of information to analyse during an investigation which can be tedious.

This week the service has become generally available. At AWS re:Invent 2019, Amazon Detective was announced as a service to investigate and identify the root cause of potential security issues or suspicious activities.

Touch detective 3 amazon