Question

A security analyst receives a GuardDuty finding indicating that an EC2 instance in the production account is communicating with a known cryptocurrency-mining IP address. Before deciding whether to isolate the instance, the analyst needs to understand whether this behavior is new, which IAM entities and API calls were involved, and how the affected resource's activity has changed over the past several weeks. Which AWS service is purpose-built to help the analyst perform this root-cause investigation with the least setup effort?

Accepted Answer

Amazon Detective, using its entity behavior graphs and interactive visualizations built from GuardDuty findings, VPC Flow Logs, and CloudTrail data

Answer

AWS Security Hub, by reviewing the aggregated finding severity scores and compliance standard checks

Answer

Amazon Inspector, by running a network reachability and software vulnerability assessment on the EC2 instance

Answer

Amazon Athena, by manually writing SQL queries against CloudTrail logs stored in an S3 bucket