Amazon Detective

Name: Amazon Detective
Brand: Amazon Web Services (AWS)

Leader

Official Global LinkedIn page for Amazon Web Services (AWS).

Est 2006|Valuation $2560B|2 Ref Customers

LinkedIn 10.9M|Website|Web traffic 1.1M|FTEs 148,001|HQ Seattle, Washington, US

MarketsThreat Intelligence Platforms Security Information and Event Management (SIEM)

Platform CoversNetwork Detection & Response (NDR)

01Competitive Landscape

Narrative analysis

#### Direct competitors and differentiators - Detective versus full SIEMs: Detective operates as an AWS-native investigation workbench rather than a system of record for cross-domain security telemetry. SIEMs are designed to centralize telemetry across identity, endpoints, SaaS, and on-premises systems. - Detective versus raw log stores (CloudWatch Logs / OpenSearch / Athena): Detective offers curated summaries, entity-relationship graphs, and an investigation UX; raw log platforms provide flexibility but require manual correlation and more analyst effort. #### Feature comparison: areas of relative strength - Integration with AWS signals and entity correlation (GuardDuty, Security Hub, Inspector finding groups) - Investigation UX aligned to AWS concepts (accounts, roles, regions, EC2, etc.) - Extended aggregated historical context in the behavior graph Sources: Official vendor documentation and announcements. #### Where alternatives excel - Microsoft Sentinel, Chronicle, and Splunk generally provide broader ingestion sources, more mature SOC workflows, and cross-domain correlation capabilities. - Splunk and Elastic offer powerful search capabilities and options for long-term retention and customized hunting, depending on deployment choices. #### Adoption / market signals - Industry review sites and other review-side signals suggest limited public review volume and lower visibility for Detective in some taxonomies. Source: Industry review sites and community discussion pages.

	Amazon Detective	Microsoft Sentinel	Datadog Cloud SIEM
Starting Price	Published usage-based pricing available from the vendor; trial option noted	Published usage-based pricing available from the vendor; regional variability and commitment tiers noted	Published pricing varies; vendor billing mechanics are documented but contract context often applies
Most suitable for	AWS-focused teams that require native investigation context for GuardDuty/Security Hub/Inspector	Azure-centric or multi-source SIEM use cases; centralized SOC workflows	Organizations already using Datadog logs/observability that seek SIEM-like detections integrated with existing telemetry
Key strength	Integration with AWS telemetry, behavior graph investigation, extended aggregated historical context	Broad SIEM/SOAR ecosystem, multi-source ingestion, Microsoft security stack integrations	Integration with Datadog telemetry and operational workflows; potential to unify ops and security signals
Key weakness	Narrower scope for non-AWS telemetry; limited public third-party review footprint	Cost and ingestion volume can grow; requires tuning and SOC maturity	Cost predictability concerns for some users; pricing/contracts can be complex at scale

01Competitive Landscape

Narrative analysis

Direct competitors and differentiators

Detective versus full SIEMs: Detective operates as an AWS-native investigation workbench rather than a system of record for cross-domain security telemetry. SIEMs are designed to centralize telemetry across identity, endpoints, SaaS, and on-premises systems.
Detective versus raw log stores (CloudWatch Logs / OpenSearch / Athena): Detective offers curated summaries, entity-relationship graphs, and an investigation UX; raw log platforms provide flexibility but require manual correlation and more analyst effort.

Feature comparison: areas of relative strength

Integration with AWS signals and entity correlation (GuardDuty, Security Hub, Inspector finding groups)
Investigation UX aligned to AWS concepts (accounts, roles, regions, EC2, etc.)
Extended aggregated historical context in the behavior graph

Sources: Official vendor documentation and announcements.

Where alternatives excel

Microsoft Sentinel, Chronicle, and Splunk generally provide broader ingestion sources, more mature SOC workflows, and cross-domain correlation capabilities.
Splunk and Elastic offer powerful search capabilities and options for long-term retention and customized hunting, depending on deployment choices.

Adoption / market signals

Industry review sites and other review-side signals suggest limited public review volume and lower visibility for Detective in some taxonomies.

Source: Industry review sites and community discussion pages.

	Amazon Detective	Microsoft Sentinel	Datadog Cloud SIEM
Starting Price	Published usage-based pricing available from the vendor; trial option noted	Published usage-based pricing available from the vendor; regional variability and commitment tiers noted	Published pricing varies; vendor billing mechanics are documented but contract context often applies
Most suitable for	AWS-focused teams that require native investigation context for GuardDuty/Security Hub/Inspector	Azure-centric or multi-source SIEM use cases; centralized SOC workflows	Organizations already using Datadog logs/observability that seek SIEM-like detections integrated with existing telemetry
Key strength	Integration with AWS telemetry, behavior graph investigation, extended aggregated historical context	Broad SIEM/SOAR ecosystem, multi-source ingestion, Microsoft security stack integrations	Integration with Datadog telemetry and operational workflows; potential to unify ops and security signals
Key weakness	Narrower scope for non-AWS telemetry; limited public third-party review footprint	Cost and ingestion volume can grow; requires tuning and SOC maturity	Cost predictability concerns for some users; pricing/contracts can be complex at scale