A security analyst receives a GuardDuty finding indicating that an IAM user's credentials may have been used from an anomalous location (UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS). The analyst needs to quickly determine the full scope of activity associated with that IAM user over the past several weeks, including which API calls were made, from which IP addresses, and whether related resources were also accessed — all without manually querying and correlating large volumes of CloudTrail, VPC Flow Logs, and GuardDuty data. Which AWS service is purpose-built to accelerate this investigation?