Detective

Question 1

Detective

What is Detective?

Answer 1

Find root cause of security findings or suspicious activity

Question 2

Detective

What types of events is it most concerned with?

Answer 2

Time-based events

Question 3

Detective

Sources of data?

Answer 3

CloudTrail, VPC Flow Logs, GuardDuty

Question 4

Detective

How does it work?

Answer 4

ML to find outliers

Question 5

Detective

How do you use Detective?

Answer 5

Interactively! You’re a detective following a trail of evidence.

Question 6

Detective

Example path of a human using Detective?

Answer 6

Start with a Finding, trace thru failed logins, other accesses by the target

Question 7

Detective

What about cross-account?

Answer 7

Whichever account enabled Detective is the admin acct. Collect data across accounts.

Question 8

Detective

Example question it tries to answer?

Answer 8

Is this spike in traffic from this instances expected?

Question 9

Detective

How do you do cross-account?

Answer 9

Organizations! Or, invite other accounts, then aggregates data across them.

Question 10

Detective

What are the account types in cross-accounts?

Answer 10

Administrator and Member (admin invites member accounts to join)

Question 11

Detective

How does Detective work with AWS Organizations?

Answer 11

Org delegates to a Detective admin account, can auto-add other Org accounts

Question 12

Detective

General work flow?

Answer 12

Let it log and analyze everything, it finds Findings (one-pagers).

Question 13

Detective

Integration with GuardDuty?

Answer 13

Detective collects data and associates it to each GuardDuty Finding.