Question

A security analyst uses Amazon Detective in a delegated administrator account to investigate a GuardDuty finding indicating that an EC2 instance made connections to a known cryptocurrency mining domain. The analyst needs to quickly understand whether the same behavior appeared across other resources, identify the earliest occurrence of the activity, and gather evidence to support an incident report — without manually correlating data from CloudTrail and VPC Flow Logs. Which Detective capability best supports this need?

Accepted Answer

Use Detective's finding group and investigation report features, which automatically cluster related findings and summarize impacted entities, involved IAM roles, and a timeline of activity

Answer

Enable Detective malware scanning on the affected EBS volume to confirm the mining binary before generating the report

Answer

Export the GuardDuty finding to Security Hub and rely on its automation rules to generate a consolidated incident timeline

Answer

Query Detective's behavior graph directly with Amazon Athena to join CloudTrail and VPC Flow Log tables and build a custom timeline