Question

A security analyst receives a GuardDuty finding indicating unusual API activity from an IAM role in a production account. Before deciding on containment, the analyst needs to understand whether this role's behavior deviates from its historical baseline over the past 45 days and which resources it has interacted with. The company already has GuardDuty, Security Hub, and Amazon Detective enabled across the organization. Which approach lets the analyst most efficiently establish this behavioral context?

Accepted Answer

Open the finding's linked Amazon Detective entity profile to view the role's activity timeline, baseline of typical API calls, and related resource interactions

Answer

Query CloudTrail Lake with a custom SQL statement to reconstruct 45 days of API calls and manually chart the frequency for the role

Answer

Enable GuardDuty Malware Protection and re-scan the account to generate a behavioral baseline for the IAM role

Answer

Use Security Hub insights to group findings by resource and infer the role's normal behavior from aggregated severity scores