Detective
Amazon Detective in Prism centralizes security investigation across the AWS accounts in your organization. From a single interface you can enrol accounts into the administrator's behavior graphs, see how many accounts and regions are being ingested, and browse the investigation reports Detective produces for the IAM users and roles involved in a security event.
What is Detective?
Amazon Detective continuously ingests AWS CloudTrail management events, Amazon VPC flow logs, and Amazon GuardDuty findings into a behavior graph, a linked model of the activity in your accounts. When someone runs an investigation against an IAM user or role, Detective analyses that graph over a time window and produces an investigation report: the entity it examined, an assigned severity, the analysis status, and the window it covered.
Prism deploys Detective centrally. One account you nominate is the administrator: it owns the behavior graph. Every other account joins that graph as a member, by invitation.
Detective uses a delegated-administrator model, not Inspector's flat peer model. One account owns the behavior graph and the others are invited into it, which is why Detective needs an administrator account and each member's AWS root email address, and Inspector needs neither. GuardDuty and Macie work the same way, so if you have enrolled either of those, Detective's enrollment flow will look familiar.
Key capabilities include:
- One behavior graph per region, Detective builds a separate behavior graph in every region you cover, so each region is separate coverage rather than a filter on one shared graph
- Invitation-based enrollment with AWS verification, Prism resolves each member's AWS root email address automatically where it can, invites the account, and waits for AWS to verify the address before accepting on the account's behalf
- Investigation reports as findings, Every cached investigation appears in the Security Hub findings inbox alongside CSPM, GuardDuty, Macie and Inspector findings, carrying an Amazon Detective chip in that list's Engine column
- IAM-entity breakdowns, Investigations are grouped by the kind of principal examined (IAM role or IAM user) and by account, so you can jump straight to the reports for one account
- Coverage first, counts second, The dashboard leads with accounts covered, regions covered and behavior graphs built, because zero investigations is a healthy state (see below)
- Standing, enumerated permissions, Prism attaches one named policy,
CKPrism-Detective-Permissions, to each enrolled account's access role: eleven Detective actions, no service wildcards, and no AWS Organizations actions
Navigation
The Detective section is accessible from the Security Hub sidebar under Amazon Detective. That row is a collapsible group rather than a link, so clicking it opens and closes the group; the landing page is the Investigations entry inside it. There are four entries:
| Sidebar entry | Description |
|---|---|
| Investigations | Coverage tiles, severity strip, and breakdowns by entity type and account |
| Findings | Browse and filter Detective investigation reports |
| Enrollment | Add, retry, and remove member accounts |
| Settings | Manage linking regions, account permissions, and disable Detective |
When Detective has not been configured yet, the group is replaced by a single greyed-out Enable Amazon Detective row. The row is greyed but still clickable, and it opens the setup wizard.
The Detective Capability Card
On Configuration > Capabilities, and on the Security Hub Overview page while no engine at all is enabled, Detective is one card in the capability grid. The card is titled Security investigation, with Amazon Detective as its subtitle, and its description reads:
Behavior-graph analysis of AWS CloudTrail, VPC flow log and GuardDuty activity, used to investigate the IAM users and roles involved in a security event.
Its capability list is IAM user and role activity, CloudTrail management events, VPC flow logs, and GuardDuty finding context.
The card's call-to-action is Enable before setup and Configure afterwards. Both go to the same place, /securityhub/detective, which is the setup wizard or the dashboard depending on what is already configured.
Detective Does Not Create Investigations on Its Own
This is the single most important thing to know before you enable Detective, because it is otherwise reported as a bug.
Amazon Detective does not generate investigation records by itself. It ingests data continuously and recommends entities worth investigating, but an investigation report exists only once somebody actually runs an investigation. Prism reads investigation reports; it never starts one and never re-triages one. The permissions Prism attaches deliberately exclude detective:StartInvestigation and detective:UpdateInvestigationState.
The consequence is direct: a tenant that enables Detective through Prism and never opens the Amazon Detective console will see zero investigations, indefinitely, and that is the correct behaviour rather than a broken engine.
The dashboard says so in words. Once Prism has refreshed and found nothing, the empty state reads:
Amazon Detective is enrolled and ingesting data across N accounts and N regions. Detective does not create investigations on its own — it recommends entities worth investigating, and a report exists only once someone runs an investigation. Prism reads those reports; it does not start them. Run an investigation from the Amazon Detective console and it will appear here after the next refresh.
The same empty state carries an Open the Detective console button, which opens the Amazon Detective console at https://console.aws.amazon.com/detective/. It is the plain console entry point, not a deep link to a particular investigation: there are no investigations yet, so there is nothing to link to.
To populate the list, run an investigation from the Amazon Detective console against an IAM role or user, then click Refresh investigations on the dashboard.
This is different from every other Security Hub capability. CSPM, GuardDuty, Macie and Inspector all produce findings on their own once enabled, so an empty list there usually means something is wrong. For Detective an empty list is the expected steady state until an investigation is run.
Root Emails Must Be Real, and AWS Verifies Them
Detective invites each member account, and AWS matches the address you supply against that account's actual AWS root user email address. This is the same requirement as GuardDuty and Macie, with one difference in how the failure shows up.
Prism resolves these addresses for you where it can. The setup wizard looks each member account's root address up automatically and only shows an input for the accounts it could not resolve, so most enrollments involve typing nothing at all. The lookup is what the self-hosted restriction below is about.
A wrong address does not fail when you submit it. The enrollment is accepted, the account moves through the invitation phases, and several minutes later AWS reports VERIFICATION_FAILED for that account. Nothing on the submit screen warns you, because at submit time nothing is wrong yet.
The fix is to correct the address and retry, never to retry as-is. Retrying with the same address fails identically, every time. The Enrollment page provides an inline email field on a verification-failed row precisely so the correction can be made where the failure is shown.
To find an account's root email, sign in to that account and open Account Settings > Account > Email address in the AWS Console. Do not use an IAM user's email, a distribution list, or an alias.
Availability on Self-Hosted Deployments
On a self-hosted Prism deployment that is not paired with CloudKeeper SaaS, Amazon Detective is unavailable and the Enable action is not offered.
The reason is the root-email requirement above. Resolving an account's real root user address requires the CloudKeeper SaaS pairing; without it, every address would have to be typed by hand and exactly right, and every mistake would fail silently minutes later as VERIFICATION_FAILED. Rather than offering an enable that is set up to fail, Prism keeps the Security investigation / Amazon Detective card on Configuration > Capabilities and puts the reason where the Enable button would be:
Amazon Detective enrolls member accounts by invitation and AWS verifies each account's real root email address. This self-hosted deployment is not paired with CloudKeeper SaaS, so Prism cannot look those addresses up. Pair this deployment to enable Amazon Detective.
The card is still rendered, with its description and capability list intact, so the capability does not silently disappear. The sidebar omits the Detective entry entirely on such a deployment, because a navigation item that cannot lead anywhere is noise. Navigating to /securityhub/detective by hand is not a way around it either: the page renders a panel headed Amazon Detective is not available on this installation, carrying the same reason and deliberately offering no Enable button.
Pairing the deployment with CloudKeeper SaaS makes Detective available without any further change; the check is re-evaluated on every request, so there is nothing to clear or restart.
SaaS deployments and paired self-hosted deployments are unaffected.
GuardDuty Is Not a Prerequisite
Amazon GuardDuty findings are one of Detective's three data sources, but Detective does not require GuardDuty to be enabled, and Prism does not check for it. Detective enables and builds its behavior graph whether or not GuardDuty is running in your accounts.
GuardDuty does matter in one specific place. If a member account joins the graph but Detective reports it as ACCEPTED_BUT_DISABLED with the reason VOLUME_UNKNOWN, the usual cause is that Detective cannot measure that account's data volume because the account is not enrolled in Amazon GuardDuty. See Enrollment for how that is surfaced and what to do about it.
Service Limits You Will Meet
Two AWS limits apply to a behavior graph, and both are enforced by AWS rather than by Prism:
| Limit | Value | What happens |
|---|---|---|
| Members per behavior graph | 1,200 | An enable or an account add that would exceed it is refused before any account is invited |
| Ingest volume per behavior graph | 10 TB / day | A member that would push the graph past it joins but is held out of ingestion, reported as VOLUME_TOO_HIGH |
The member limit has a consequence worth knowing in advance: an account that was invited but never verified still occupies one of the 1,200 slots, because AWS counts it as a member from the moment the invitation is created. An abandoned partial enrollment therefore consumes quota, not merely coverage. Retry those accounts or remove them; see Enrollment.
Supported Regions
Two lists are involved, and they are not the same length.
Amazon Detective has an endpoint in 21 commercial AWS regions, and the backend refuses any region outside that list before it touches AWS. Selecting a region Detective does not reach is what that guard exists to prevent, because an unreachable endpoint fails the whole enablement rather than that one region.
| Area | Regions Detective reaches |
|---|---|
| Americas | us-east-1, us-east-2, us-west-1, us-west-2, ca-central-1, sa-east-1 |
| Europe, Middle East & Africa | eu-west-1, eu-west-2, eu-west-3, eu-central-1, eu-north-1, eu-south-1, af-south-1, il-central-1, me-south-1 |
| Asia Pacific | ap-northeast-1, ap-northeast-2, ap-south-1, ap-southeast-1, ap-southeast-2, ap-east-1 |
The region pickers offer 16 of them. A picker is the intersection of that 21-region list with Prism's own shared AWS region list, which is used by every Security Hub capability and is the shorter of the two. The 16 offered today are:
us-east-1, us-east-2, us-west-1, us-west-2, ca-central-1, sa-east-1, eu-west-1, eu-west-2, eu-west-3, eu-central-1, eu-north-1, ap-northeast-1, ap-northeast-2, ap-south-1, ap-southeast-1, ap-southeast-2.
The setup wizard offers exactly those 16. The Settings page offers the same 16 plus any region your configuration already holds, so a region that later drops off the list can still be seen and removed rather than becoming permanently stuck.
Opt-In Regions
Five of Detective's 21 regions are opt-in regions: af-south-1, ap-east-1, eu-south-1, il-central-1, and me-south-1. Detective has an endpoint in each, but an AWS account must enable the region for itself before it can be used, so a region that works for one account can be unusable in the next.
Prism handles that per account rather than per region: it never refuses an opt-in region outright, and if an account has not opted in, the enablement reports that the region is not enabled for that specific account, naming it. Refusing outright would tell a customer who has enabled eu-south-1 that Detective is unavailable there, which is false.
None of the five is in Prism's shared region list today, so the pickers do not currently offer them; the per-account handling above applies if the shared list gains one.
Regions With No Detective Endpoint
Canada West (Calgary) ca-west-1 and Asia Pacific (Osaka) ap-northeast-3 have no Amazon Detective endpoint. ap-northeast-3 is the one region Prism's shared list carries that Detective cannot reach, and it is exactly what the intersection above filters out — it is offered for other capabilities and not for Detective.
Cost & Billing
Amazon Detective bills on the volume of data ingested into the behavior graph, per account, per region, per GB. There is no scan-type selection and no per-resource charge, so the levers available to you are which accounts you enrol and which regions you cover.
Two implications follow:
- Adding a linking region creates a new behavior graph in that region and starts ingestion, and its charges, for every enrolled account.
- Removing an account or a region stops its ingestion and its charges.
AWS offers a free trial period for Amazon Detective per account. Consult the AWS Detective pricing page for authoritative and region-specific rates.
Prerequisites
Before using Detective, ensure the following:
- Your organization has been onboarded to Prism by CloudKeeper
- Security Hub has been enabled for your organization as a beta feature by CloudKeeper
- Security Hub access enabled for your account by an Admin in Preferences > Admin Management
- At least one AWS account is onboarded in Prism to serve as the administrator account
- You can supply the real AWS root user email address for any member account Prism cannot resolve automatically
- On a self-hosted deployment, the deployment is paired with CloudKeeper SaaS
Related Pages
- Enabling Detective, Run the three-step setup wizard
- Investigations dashboard, Coverage tiles, severity strip, and breakdowns
- Findings, Browse and filter investigation reports
- Enrollment, Manage which accounts are in the behavior graph
- Settings, Manage regions, permissions, and disable Detective
- Configuration, Enable Detective as an additional engine
- Security Hub Issues, Troubleshooting enrollment and verification problems