A GuardDuty finding shows an EC2 instance talking to a known-malicious IP. The team wants to visualize related API calls, network flows, and IAM activity around it — without building queries. Which service is designed for this triage?
A.Amazon Detective
Correct. Detective is the investigation/analysis layer over findings and telemetry.
B.AWS CloudTrail event history
Event history shows API calls only — you'd manually correlate with flows and IAM activity.
C.VPC Flow Logs in Athena
Athena queries flows but requires writing queries and joining sources yourself.
D.Amazon Macie
Macie finds sensitive data in S3 — unrelated to incident triage.
Why this answer
Detective ingests GuardDuty findings, VPC Flow Logs, and CloudTrail into a behavior graph — purpose-built for visual investigation: see what an entity touched, when, and how, without manual log correlation.
Correct answer: A · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Detection & Response practice session.
Practice Detection & Response