Amazon Detective helps you investigate and get to the root cause of security findings. It automatically builds a linked view of your resources, activity, and GuardDuty findings so you can analyze suspicious behavior.
Detective vs GuardDuty
GuardDuty detects a threat and raises a finding. Detective helps you investigate that finding — visualizing the activity timeline and relationships to determine what happened. Detection = GuardDuty; deep investigation/root cause = Detective.
Test yourself
After GuardDuty raises an alert, a security analyst needs to investigate the root cause by visualizing the related activity and resource behavior over time. Which service?
- Amazon Inspector
- Amazon Detective
- AWS Config
- Amazon Macie
👉 Click to reveal the answer & explanation
Correct answer: B. Detective is purpose-built to investigate and find the root cause of security findings by correlating activity and GuardDuty alerts. Inspector (A) scans for vulnerabilities; Config (C) tracks configuration; Macie (D) discovers sensitive data.
Related topics
Amazon GuardDuty · Amazon Inspector · AWS CloudTrail
Ready to pass the AWS Solutions Architect Associate (SAA-C03)?
Stop guessing whether you’re ready. Our full-length, exam-realistic practice exams put you through the exact question style you’ll face — with a detailed explanation behind every answer, so you learn why, not just what.
- ✓ 6 full-length practice exams
- ✓ A detailed explanation for every single question
- ✓ Realistic, scenario-based questions — not memory dumps
- ✓ Lifetime access, kept current for 2026
Get the SAA-C03 Practice Exams →or try 25 free questions first