Lesson 08 — Amazon Detective, Threat Investigation, Root Cause Analysis & Digital Forensics

Learning Path

☁️ Phase 02 – AWS Cloud Security

📘 Module 13 – Enterprise Security Operations, Logging, Monitoring & Threat Detection

🎯 Lesson Objectives

By the end of this lesson, you will be able to:

Explain Amazon Detective architecture.
Understand graph-based security investigations.
Enable Amazon Detective across AWS Organizations.
Configure delegated administrator accounts.
Investigate GuardDuty findings.
Perform root cause analysis.
Analyse IAM user behaviour.
Investigate EC2 instances.
Analyse network activity.
Investigate API behaviour.
Understand entity profiles.
Understand behaviour graphs.
Correlate findings across AWS services.
Integrate Detective with GuardDuty.
Integrate Detective with Security Hub.
Build enterprise investigation workflows.
Improve Mean Time to Investigate (MTTI).
Design enterprise investigation governance.
Apply digital forensic methodologies.
Apply Amazon Detective best practices.

📚 Lesson Information

Area	Details
Estimated Time	8–10 Hours
Difficulty	Advanced
Prerequisites	Lesson 07 – AWS Security Hub
Hands-on Labs	Yes
AWS Services	Amazon Detective, GuardDuty, Security Hub, CloudTrail, AWS Organizations, IAM, EC2, VPC

💼 Business Scenario

CloudNova Technologies has deployed:

AWS CloudTrail
Amazon CloudWatch
AWS Config
Amazon GuardDuty
AWS Security Hub

The Security Operations Centre (SOC) receives hundreds of GuardDuty findings every week.

Although GuardDuty successfully detects suspicious activity, analysts spend several hours manually collecting information from multiple AWS services before understanding the complete attack.

Recent incidents include:

IAM credentials used from multiple countries.
EC2 instances communicating with known command-and-control servers.
Privilege escalation attempts.
Suspicious S3 data access.
Lateral movement across AWS accounts.
Compromised Kubernetes workloads.
Unusual API activity.

Security analysts must manually search:

CloudTrail
VPC Flow Logs
IAM
EC2
Security Hub
GuardDuty

The investigation process is slow and inconsistent.

The Chief Information Security Officer (CISO) asks:

“How can our analysts quickly understand who was involved, what happened, how the attacker moved through the environment and what the root cause was?”

As CloudNova’s Cloud Security Architect, you are responsible for implementing Amazon Detective to accelerate enterprise investigations and improve incident response.

1. Introduction to Amazon Detective

Topics:

What is Amazon Detective?
Why Amazon Detective matters.
Graph-based security analysis.
Behaviour analysis.
Root cause analysis.
Digital investigations.
Security analytics.

2. Amazon Detective Architecture

Explain:

Behavior Graph
Entity Profiles
Investigation Dashboard
Data Sources
GuardDuty Integration
Security Hub Integration
AWS Organizations

Architecture Diagram

CloudTrail

↓

GuardDuty

↓

VPC Flow Logs

↓

IAM Activity

↓

Amazon Detective

↓

Behavior Graph

↓

SOC Analyst

↓

Incident Response

3. How Amazon Detective Works

Explain:

Data collection
Data correlation
Behaviour modelling
Graph creation
Entity analysis
Investigation workflow
Root cause analysis

4. Detective Data Sources

Amazon Detective automatically analyses:

AWS CloudTrail
Amazon GuardDuty Findings
VPC Flow Logs
IAM Activity
EC2 Metadata
AWS Organizations

Explain how these sources provide context for investigations.

5. Behavior Graph

Topics:

What is a Behavior Graph?
Relationships
Timeline analysis
Connected entities
Resource interactions
Investigation acceleration

6. Entity Profiles

Analyse:

IAM Users
IAM Roles
EC2 Instances
AWS Accounts
IP Addresses
API Calls

Explain how entity profiles help analysts understand historical behaviour.

7. Investigation Workflow

Enterprise workflow:

Detection

↓

GuardDuty Finding

↓

Security Hub

↓

Amazon Detective

↓

Root Cause Analysis

↓

Containment

↓

Recovery

↓

Lessons Learned

8. IAM Investigations

Investigate:

Suspicious Console Logins
Impossible Travel
Unusual API Activity
Privilege Escalation
Credential Abuse
Cross-account Access

9. EC2 Investigations

Analyse:

Network connections
Process activity
Security Groups
Attached IAM Roles
Instance metadata
Communication patterns

10. Network Investigation

Review:

Source IP
Destination IP
VPC Traffic
DNS Requests
Command-and-Control traffic
Suspicious communications

11. API Investigation

Investigate:

CloudTrail API history
Failed API calls
Administrative changes
Resource modifications
User behaviour
Timeline analysis

12. Root Cause Analysis

Topics:

Initial compromise
Privilege escalation
Persistence
Lateral movement
Data access
Exfiltration
Impact assessment

13. Timeline Analysis

Create investigation timelines using:

API Calls
Login Events
Resource Changes
Security Findings
Network Activity
Compliance Events

14. Multi-Account Investigation

Explain:

AWS Organizations
Delegated Administrator
Cross-account investigations
Enterprise visibility
Investigation ownership

15. Detective Integration

Amazon Detective integrates with:

Amazon GuardDuty
AWS Security Hub
AWS Organizations
CloudTrail
IAM
VPC Flow Logs

16. Digital Forensics

Discuss:

Evidence collection
Timeline reconstruction
Evidence preservation
Chain of custody
Root cause documentation
Investigation reporting

17. Enterprise Governance

Govern:

Investigation ownership
Case documentation
Escalation procedures
Evidence handling
Root cause reviews
Reporting
Retention
Audit requirements

18. Detective Threat Model

Investigate:

Credential theft
Privilege escalation
Insider threats
Malware
Lateral movement
Persistence
Data exfiltration
Command-and-Control traffic

19. Enterprise Detective Architecture

CloudTrail

↓

GuardDuty

↓

Security Hub

↓

Amazon Detective

↓

Behavior Graph

↓

SOC Investigation

↓

Incident Response

↓

Executive Reporting

20. Enterprise Incident Investigation Lifecycle

Alert Generated

↓

Threat Validation

↓

Context Collection

↓

Behavior Analysis

↓

Root Cause Analysis

↓

Containment

↓

Recovery

↓

Lessons Learned

🛠 Enterprise Labs

Lab 01

Enable Amazon Detective Across AWS Organizations

Lab 02

Configure Delegated Administrator

Lab 03

Investigate IAM Credential Compromise

Lab 04

Investigate EC2 Malware Activity

Lab 05

Investigate Suspicious Network Communications

Lab 06

Investigate Privilege Escalation

Lab 07

Perform Root Cause Analysis

Lab 08

Correlate Security Hub and GuardDuty Findings

Lab 09

Build an Enterprise Investigation Report

Lab 10

Enterprise Threat Investigation Assessment

💻 AWS Console Walkthrough

Students should explore:

Detective Dashboard
Behavior Graph
Entity Profiles
Investigation Panel
GuardDuty Findings
Security Hub Integration
Investigation Timeline
Related Findings
Evidence Collection

💻 AWS CLI Exercises

Note: Amazon Detective has limited AWS CLI support compared to services such as CloudTrail or GuardDuty. In enterprise environments, most investigations are performed through the AWS Management Console or automated APIs.

# List behavior graphs
aws detective list-graphs

# List members
aws detective list-members \
  --graph-arn GRAPH_ARN

# List invitations
aws detective list-invitations

# Get graph details
aws detective get-members \
  --graph-arn GRAPH_ARN \
  --account-ids ACCOUNT_ID

✅ Verification Checklist

Students should be able to:

Explain Amazon Detective architecture.
Configure Detective across AWS Organizations.
Understand Behavior Graphs.
Investigate IAM activity.
Investigate EC2 instances.
Analyse network behaviour.
Perform root cause analysis.
Correlate GuardDuty findings.
Integrate Security Hub.
Build enterprise investigation workflows.

🏢 Enterprise Best Practices

CloudNova standards:

Enable Amazon Detective in all supported Regions.
Use AWS Organizations with a delegated administrator.
Integrate Detective with GuardDuty and Security Hub.
Standardise investigation procedures across the SOC.
Document every investigation with evidence and timelines.
Correlate multiple findings before determining root cause.
Preserve investigation evidence according to organisational policies.
Conduct post-incident reviews to improve detection and response.
Regularly train analysts on graph-based investigation techniques.
Monitor investigation metrics such as Mean Time to Investigate (MTTI).

🚫 Common Mistakes

Treating Amazon Detective as a threat detection service instead of an investigation platform.
Ignoring entity relationships during investigations.
Focusing on a single finding instead of the complete attack chain.
Failing to document investigation timelines.
Not correlating findings from multiple AWS services.
Skipping root cause analysis after containment.
Not preserving evidence for compliance or legal purposes.
Assuming all GuardDuty findings require the same investigation process.
Neglecting cross-account investigations.
Closing investigations without lessons learned.

🧪 DIY Enterprise Challenge

Design CloudNova’s enterprise investigation platform supporting:

500 AWS accounts
Multi-Region deployment
AWS Organizations
GuardDuty integration
Security Hub integration
Enterprise SOC
Root cause analysis
Digital forensics
Executive reporting
Regulatory investigations

Prepare:

Enterprise investigation architecture
Investigation workflow
Root cause analysis methodology
Evidence collection process
SOC escalation matrix
Governance framework
Investigation reporting template
Continuous improvement roadmap

📊 Knowledge Check

Create and answer 50 enterprise-level questions covering:

Amazon Detective architecture
Behavior Graph
Entity Profiles
Data Sources
Root Cause Analysis
IAM investigations
EC2 investigations
Network investigations
Timeline analysis
Security Hub integration
GuardDuty integration
Digital forensics
Enterprise governance
Incident response
Investigation best practices

💡 Key Takeaways

After completing this lesson, you should be able to:

Deploy Amazon Detective across enterprise AWS environments.
Use Behavior Graphs and Entity Profiles to accelerate investigations.
Perform root cause analysis for cloud security incidents.
Correlate findings from GuardDuty, Security Hub and CloudTrail.
Build structured investigation workflows that improve Mean Time to Investigate (MTTI).
Strengthen enterprise incident response through evidence-based investigations and digital forensics.

🚀 Next Lesson

➡️ Lesson 09 — Amazon Inspector, Vulnerability Management, Continuous Security Assessments & Enterprise Patch Governance