performing-cloud-native-threat-hunting-with-aws-detective

name	performing-cloud-native-threat-hunting-with-aws-detective
description	Investigate AWS security incidents using Amazon Detective's behavior graphs, built from CloudTrail, VPC Flow Logs, GuardDuty, and EKS audit logs, to trace entity timelines and profile IAM users, roles, EC2 instances, and IP addresses for lateral movement. Use when triaging GuardDuty findings, investigating a suspected AWS compromise, or reconstructing an attacker's activity timeline across AWS accounts.
domain	cybersecurity
subdomain	cloud-security
tags	["aws-detective","threat-hunting","cloud-security","guardduty","behavior-graph","aws","iam","ec2","incident-investigation"]
version	1.0
author	juliosuas
license	Apache-2.0
nist_csf	["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"]
mitre_attack	["T1078.004","T1530","T1537","T1580","T1071"]

Performing Cloud-Native Threat Hunting with AWS Detective

Overview

AWS Detective automatically collects and analyzes log data from AWS CloudTrail, VPC Flow Logs, GuardDuty findings, and EKS audit logs to build interactive behavior graphs. These graphs enable security analysts to investigate entities (IAM users, roles, IP addresses, EC2 instances) across time, identify anomalous API calls, detect lateral movement between accounts, and correlate GuardDuty findings into coherent attack narratives — all without manual log parsing.

Prerequisites

• AWS account with Detective enabled (requires GuardDuty active for 48+ hours)
• AWS CLI v2 configured with appropriate IAM permissions (detective:*, guardduty:List*)
• Python 3.9+ with boto3
• IAM policy: AmazonDetectiveFullAccess or custom policy with detective:SearchGraph, detective:GetInvestigation, detective:ListIndicators

Key Concepts

Concept	Description
Behavior Graph	Data structure linking CloudTrail, VPC Flow, GuardDuty, and EKS logs for an account/region
Entity	Investigable object: IAM user, IAM role, EC2 instance, IP address, S3 bucket, EKS cluster
Finding Group	Correlated set of GuardDuty findings linked to the same attack campaign
Entity Profile	Timeline of API calls, network connections, and resource access for a specific entity
Scope Time	Investigation window (default 24h, max 1 year) for behavioral analysis

Steps

Step 1: List Available Behavior Graphs

aws detective list-graphs --output table

Step 2: Investigate a Suspicious IAM User

# Get entity profile for an IAM user
aws detective get-investigation \
  --graph-arn arn:aws:detective:us-east-1:123456789012:graph:a1b2c3d4 \
  --investigation-id 000000000000000000001

Step 3: Search Entities Programmatically

#!/usr/bin/env python3
"""Search AWS Detective for suspicious entities."""
 boto3
 json
 datetime  datetime, timedelta

detective = boto3.client()

 ():
    
    response = detective.list_graphs()
     response.get(, [])

 ():
    
    response = detective.list_indicators(
        GraphArn=graph_arn,
        InvestigationId=investigation_id,
        MaxResults=max_results
    )
     response.get(, [])

 ():
    
    response = detective.list_investigations(
        GraphArn=graph_arn,
        FilterCriteria={
            : {: },
            : {: }
        },
        MaxResults=
    )

     investigation  response.get(, []):
        ()
        ()
        ()
        ()
        ()
        ()

 __name__ == :
    graphs = list_behavior_graphs()
     graph  graphs:
        ()
        investigate_guardduty_findings(graph[])