Amazon Detective

Name: Amazon Detective
Brand: Amazon Web Services (AWS)

Leader

Official Global LinkedIn page for Amazon Web Services (AWS).

Est 2006|Valuation $2560B|2 Ref Customers

LinkedIn 10.9M|Website|Web traffic 1.1M|FTEs 148,001|HQ Seattle, Washington, US

MarketsThreat Intelligence Platforms Security Information and Event Management (SIEM)

Platform CoversNetwork Detection & Response (NDR)

Published Oct 13, 2026

01Common complaints

1) A single-pane enterprise SIEM is required - If requirements include ingesting identity provider logs, endpoint telemetry, SaaS audit logs, on-prem network logs, and centralized correlation, SIEMs such as Microsoft Sentinel, Splunk, or Chronicle typically align better. 2) A multi-cloud environment requires a cloud-agnostic investigation plane - Detective’s strongest value is within AWS. Multi-cloud environments may prefer a cloud-agnostic platform or a vendor-neutral data lake plus SIEM. 3) Highly constrained security budgets with unpredictable log volume - Usage-based per-GB ingest can result in unexpected cost growth if log volume increases quickly. 4) Need for abundant third-party validation or independent reviews - Public review coverage for the service itself is limited on major review platforms, which may reduce available external evidence. 5) Requirement for integrated SOAR/case management - Detective focuses on investigation and analysis; organizations may still require a separate SOAR or case-management platform for end-to-end incident handling.

Deal disqualifiers (poor fit)

Primary environment is not AWS or is strongly multi-cloud/on-prem and a single investigation plane is required
Requirement for data retention beyond the tool's standard retention window
Mature SIEM and threat-hunting capabilities already in place where Detective would provide limited incremental value

Publicly documented limitations

Regional service: must be enabled per region.
Account scaling / quotas: AWS guidance notes approximately 1,200 accounts per behavior graph (contact AWS for larger needs).
Historical window: up to one year of historical aggregated data for analysis.

Sources: AWS best practices guide; product documentation.

Limitations reported in community support channels

AWS re:Post questions suggest potential confusion about finding types or console behavior, implying an operational learning curve.

Source: AWS re:Post.

Roadmap / future features

No authoritative, dated roadmap items were captured in the sources reviewed; AWS does not typically publish detailed product roadmaps publicly.

02Why they buy

Key differentiators supported by available evidence

Integration with AWS telemetry to build entity relationships and behavior graphs from CloudTrail, VPC Flow Logs, GuardDuty, Security Hub, and Inspector data.
Integration with GuardDuty and Security Hub findings and extension to Inspector-related finding groups.
One-year rolling aggregated analysis window for investigation history.

Sources: AWS documentation; AWS announcements.

Areas where competitors have advantages

Broader data source coverage and hunting flexibility (Splunk, Sentinel, Chronicle)
More mature third-party review ecosystems and independent validation
More extensive SOC workflow capabilities (case management, automation, playbook ecosystems)

03Field reports

Availability caveat: review coverage is thin

Amazon Detective has limited presence on mainstream review platforms as a distinct product; it is often discussed within broader AWS contexts. In this research session: - Gartner Peer Insights: no accessible, product-specific review page for Amazon Detective was obtained. - G2 / TrustRadius: no clear, product-specific listing with direct end-user reviews for Amazon Detective was found in accessible sources. - PeerSpot: shows no public reviews for Amazon Detective in at least one comparison context. This results in limited public review volume: most public commentary is from community threads and secondary analysis rather than large volumes of verified reviews.

Community / Reddit commentary (mixed)

From community threads around the GA announcement:

Some participants described GuardDuty as generating alerts while Detective is used to analyze related events.
Cost concerns were expressed by several commenters.

Another Reddit thread about GA contained announcement-style comments with limited detailed feedback.

AWS re:Post (indicative issues and usage patterns)

AWS re:Post contains community Q&A tagged Amazon Detective, with examples such as users asking about specific finding types appearing in the Detective console. This indicates:

Operational usage in the community
Some friction in interpreting findings or changes in console behavior

Inferred customer uses

Across AWS documentation and community commentary, primary reasons cited for adopting Detective include:

Native correlation of AWS signals (GuardDuty/Security Hub/Inspector)
Visual investigation with historical context (historical retention on the order of months)
Reduction in manual log stitching during incident response

Reasons some organizations may not choose Detective (inferred)

The service is AWS-focused; multi-cloud or on-prem-first organizations may prefer a SIEM or cloud-agnostic platform.
Usage-based ingest costs are additive and can increase overall security spend.
Teams with mature SIEM plus threat-hunting workflows may find Detective provides limited incremental value.

Availability caveat

There were limited customer-named case studies with quantified outcomes for Amazon Detective in the sources accessed (for example, quantified reductions in investigation time or MTTR). Available materials were mainly:

AWS launch posts
AWS Security Blog how-to investigations
AWS best practices guidance

Example: IAM investigations (AWS Security Blog)

The AWS Security Blog describes using Detective for investigating IAM principals to determine whether a principal is involved in a security event.

Critical evaluation:

This content is educational and not an independently verified case study.
It demonstrates workflows but does not provide quantified outcomes or comparative analysis versus alternatives.

Vendor-published metrics disclaimer

Where AWS content implies faster investigations, such claims are generally qualitative unless accompanied by a reproducible methodology. Measurable ROI or quantified reductions in investigation time were not found in the sources accessed.

04Best fit

Company sizes

Most suitable: mid-market to enterprise organizations operating multiple AWS accounts and regions (often via AWS Organizations).
Also plausible: smaller teams with AWS-heavy workloads seeking an AWS-native investigation capability without deploying a full SIEM—cost relative to cloud spend may be a constraint.

Industries

Strongest fit where AWS adoption is deep and security/compliance is material:
- SaaS
- Fintech
- E-commerce
- Media/streaming
- Regulated industries using AWS (subject to compliance validation)

Roles / personas

Decision makers: CISO, Head of Cloud Security, Director of Security Engineering
Champions/users: Cloud Security Engineer, Incident Responder, Security Analyst
Influencers: Platform engineering / SRE (because log sources and account baselining affect ingest)

Qualification criteria (most suitable)

GuardDuty and Security Hub already deployed (or planned)
Need to reduce investigation time spent correlating CloudTrail/VPC flows manually
Organization can operationalize regional enablement and access controls

05The pitch

What the product does (objective value proposition)

Amazon Detective is an AWS-managed security investigation service that assists security teams in analyzing and investigating security findings and suspicious activity across AWS environments. It aggregates telemetry (for example, AWS CloudTrail, VPC Flow Logs, and other supported sources), then applies analytics (AWS describes machine learning, statistical analysis, and graph theory) to produce visualizations and contextual information intended to reduce time to root-cause analysis. Detective is typically used after a detection tool (most commonly Amazon GuardDuty / AWS Security Hub) raises a finding; Detective’s role is investigation and correlation rather than primary detection. Official positioning emphasizes: - Reduced time to triage and root-cause analysis through behavior graphs and investigative visualizations. - Correlation of findings (including GuardDuty and, optionally, Security Hub findings, and Inspector findings via finding groups). Sources: Official vendor documentation and launch/feature announcements.

Target market and market positioning

- Target market: AWS-centric organizations running production workloads on AWS—especially those with multiple accounts/regions and a need to centralize investigations. - Positioning: A cloud-native investigation layer within the AWS security stack (commonly paired with GuardDuty + Security Hub + Inspector). - Typical buyers/users: Security Operations (SecOps), incident responders, cloud security engineers, and platform security teams. AWS documents identify security practitioners investigating findings and anomalies as primary users of Detective.

Get a comprehensive analysis of Amazon Detective including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →

Published Oct 13, 2026

01Common complaints

A single-pane enterprise SIEM is required

If requirements include ingesting identity provider logs, endpoint telemetry, SaaS audit logs, on-prem network logs, and centralized correlation, SIEMs such as Microsoft Sentinel, Splunk, or Chronicle typically align better.

A multi-cloud environment requires a cloud-agnostic investigation plane

Detective’s strongest value is within AWS. Multi-cloud environments may prefer a cloud-agnostic platform or a vendor-neutral data lake plus SIEM.

Highly constrained security budgets with unpredictable log volume

Usage-based per-GB ingest can result in unexpected cost growth if log volume increases quickly.

Need for abundant third-party validation or independent reviews

Public review coverage for the service itself is limited on major review platforms, which may reduce available external evidence.

Requirement for integrated SOAR/case management

Detective focuses on investigation and analysis; organizations may still require a separate SOAR or case-management platform for end-to-end incident handling.

Deal disqualifiers (poor fit)

Primary environment is not AWS or is strongly multi-cloud/on-prem and a single investigation plane is required
Requirement for data retention beyond the tool's standard retention window
Mature SIEM and threat-hunting capabilities already in place where Detective would provide limited incremental value

Publicly documented limitations

Regional service: must be enabled per region.
Account scaling / quotas: AWS guidance notes approximately 1,200 accounts per behavior graph (contact AWS for larger needs).
Historical window: up to one year of historical aggregated data for analysis.

Sources: AWS best practices guide; product documentation.

Limitations reported in community support channels

AWS re:Post questions suggest potential confusion about finding types or console behavior, implying an operational learning curve.

Source: AWS re:Post.

Roadmap / future features

No authoritative, dated roadmap items were captured in the sources reviewed; AWS does not typically publish detailed product roadmaps publicly.

02Why they buy

Key differentiators supported by available evidence

Integration with AWS telemetry to build entity relationships and behavior graphs from CloudTrail, VPC Flow Logs, GuardDuty, Security Hub, and Inspector data.
Integration with GuardDuty and Security Hub findings and extension to Inspector-related finding groups.
One-year rolling aggregated analysis window for investigation history.

Sources: AWS documentation; AWS announcements.

Areas where competitors have advantages

Broader data source coverage and hunting flexibility (Splunk, Sentinel, Chronicle)
More mature third-party review ecosystems and independent validation
More extensive SOC workflow capabilities (case management, automation, playbook ecosystems)

03Field reports

Availability caveat: review coverage is thin

Amazon Detective has limited presence on mainstream review platforms as a distinct product; it is often discussed within broader AWS contexts. In this research session:

Gartner Peer Insights: no accessible, product-specific review page for Amazon Detective was obtained.
G2 / TrustRadius: no clear, product-specific listing with direct end-user reviews for Amazon Detective was found in accessible sources.
PeerSpot: shows no public reviews for Amazon Detective in at least one comparison context.

This results in limited public review volume: most public commentary is from community threads and secondary analysis rather than large volumes of verified reviews.

Community / Reddit commentary (mixed)

From community threads around the GA announcement:

Some participants described GuardDuty as generating alerts while Detective is used to analyze related events.
Cost concerns were expressed by several commenters.

Another Reddit thread about GA contained announcement-style comments with limited detailed feedback.

AWS re:Post (indicative issues and usage patterns)

AWS re:Post contains community Q&A tagged Amazon Detective, with examples such as users asking about specific finding types appearing in the Detective console. This indicates:

Operational usage in the community
Some friction in interpreting findings or changes in console behavior

Inferred customer uses

Across AWS documentation and community commentary, primary reasons cited for adopting Detective include:

Native correlation of AWS signals (GuardDuty/Security Hub/Inspector)
Visual investigation with historical context (historical retention on the order of months)
Reduction in manual log stitching during incident response

Reasons some organizations may not choose Detective (inferred)

The service is AWS-focused; multi-cloud or on-prem-first organizations may prefer a SIEM or cloud-agnostic platform.
Usage-based ingest costs are additive and can increase overall security spend.
Teams with mature SIEM plus threat-hunting workflows may find Detective provides limited incremental value.

Availability caveat

AWS launch posts
AWS Security Blog how-to investigations
AWS best practices guidance

Example: IAM investigations (AWS Security Blog)

The AWS Security Blog describes using Detective for investigating IAM principals to determine whether a principal is involved in a security event.

Critical evaluation:

This content is educational and not an independently verified case study.
It demonstrates workflows but does not provide quantified outcomes or comparative analysis versus alternatives.

Vendor-published metrics disclaimer

04Best fit

Company sizes

Most suitable: mid-market to enterprise organizations operating multiple AWS accounts and regions (often via AWS Organizations).
Also plausible: smaller teams with AWS-heavy workloads seeking an AWS-native investigation capability without deploying a full SIEM—cost relative to cloud spend may be a constraint.

Industries

Strongest fit where AWS adoption is deep and security/compliance is material:
- SaaS
- Fintech
- E-commerce
- Media/streaming
- Regulated industries using AWS (subject to compliance validation)

Roles / personas

Decision makers: CISO, Head of Cloud Security, Director of Security Engineering
Champions/users: Cloud Security Engineer, Incident Responder, Security Analyst
Influencers: Platform engineering / SRE (because log sources and account baselining affect ingest)

Qualification criteria (most suitable)

GuardDuty and Security Hub already deployed (or planned)
Need to reduce investigation time spent correlating CloudTrail/VPC flows manually
Organization can operationalize regional enablement and access controls

05The pitch

What the product does (objective value proposition)

Detective is typically used after a detection tool (most commonly Amazon GuardDuty / AWS Security Hub) raises a finding; Detective’s role is investigation and correlation rather than primary detection.

Official positioning emphasizes:

Reduced time to triage and root-cause analysis through behavior graphs and investigative visualizations.
Correlation of findings (including GuardDuty and, optionally, Security Hub findings, and Inspector findings via finding groups).

Sources: Official vendor documentation and launch/feature announcements.

Target market and market positioning

Target market: AWS-centric organizations running production workloads on AWS—especially those with multiple accounts/regions and a need to centralize investigations.
Positioning: A cloud-native investigation layer within the AWS security stack (commonly paired with GuardDuty + Security Hub + Inspector).
Typical buyers/users: Security Operations (SecOps), incident responders, cloud security engineers, and platform security teams.

AWS documents identify security practitioners investigating findings and anomalies as primary users of Detective.

Get a comprehensive analysis of Amazon Detective including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →