Dashboard
The Detective Investigations dashboard is the landing page for Amazon Detective after setup completes. It reports how much of your estate the behavior graph covers, breaks the cached investigation reports down by severity, entity type and account, and provides the refresh that pulls investigations from AWS.
Accessing the Dashboard
In the Security Hub sidebar, click Amazon Detective to open its group, then Investigations. The parent row only opens and closes the group; Investigations is the entry that navigates here. The page itself is headed Detective Investigations.
Header
The header's subtitle is the deployment, in four parts: the administrator account, the home region, "N accounts across M regions", and "Last refresh: …" as a relative time (just now, 4 min ago, 2 h ago, 3 d ago, or never). On the loading and empty states, before there are any counts to state, it shortens to the administrator and the home region alone. The action beside it is Refresh investigations, which fetches the latest investigations from AWS.
If the configuration is in partial failure, a warning banner reads "Some accounts are not fully enrolled in the behavior graph." followed by whatever message the last operation recorded, with a Review button that opens Enrollment.
The dashboard reads from Prism's cache of the last refresh, not live AWS data. Click Refresh investigations to fetch current investigations. If a refresh started elsewhere is already running when you open the page, the dashboard detects it and picks up its progress rather than showing an idle page.
Coverage Tiles
Coverage leads the page, ahead of any count of investigations. This is deliberate: zero investigations is a healthy state for Detective, so a zero at the top of the page would state the opposite of what is true.
| Tile | Caption | Meaning |
|---|---|---|
| Accounts covered | enrolled in the behavior graph | How many accounts are enrolled. Opens Enrollment |
| Regions covered | regions ingesting data | How many regions are ingesting data. Opens Settings |
| Behavior graphs | one graph per covered region | How many behavior graphs actually exist. Opens Settings |
Behavior graphs and Regions covered should match. Amazon Detective builds one graph per region, so an equal count is the healthy case and the tile is green. If there are fewer graphs than regions, the tile turns amber and its caption changes to "fewer graphs than regions — a region has no graph", with a tooltip explaining that such a region is not ingesting anything. Re-run the region update from Settings to build the missing graph.
The administrator account is included in Accounts covered. It is a member of its own behavior graph — its own CloudTrail and VPC flow log activity is ingested, and AWS's own ListMembers returns it — so it is a covered account and is counted as one. Enrolling a single member account therefore shows 2 here, matching the two rows on the Enrollment page for the same tenant.
Investigation Counts
Below the coverage tiles, a line summarises the cache:
N investigations cached · N active · N archived
Archived investigations are counted from the same cache as active ones; Detective's list call returns both, so no extra work is done to produce this number.
Severity Strip
Five tiles break the cached investigations down by the severity Amazon Detective assigned:
| Tile | Meaning |
|---|---|
| Critical | Critical severity investigations |
| High | High severity investigations |
| Medium | Medium severity investigations |
| Low | Low severity investigations |
| Informational | Investigations Detective classified as informational. Its tooltip reads "Reported for awareness — the investigation found nothing that needs action." |
Each tile's caption is investigation or investigations, and clicking one opens Findings pre-filtered to that severity. All five are always rendered, including at zero.
If AWS ever returns a severity outside those five, it gets its own tile appended after them rather than being dropped or folded into a neighbouring band.
The Unrated Tile
A sixth tile, Unrated, appears in a neutral colour after the strip when, and only when, the count is non-zero.
Unrated does not mean unimportant. Amazon Detective returns an investigation's severity with the full investigation report, not in the list of investigations. A refresh reads the list, so a freshly refreshed investigation arrives with no severity at all, and Prism fills the severity in when the investigation is opened.
On a freshly refreshed tenant, therefore, every investigation is unrated, and the five severity bands legitimately read zero beside a non-zero investigation count. The Unrated tile is what makes the numbers add up; without it the strip would sum to less than the total with nothing explaining the gap.
A sentence beneath the strip repeats the explanation, and the tile itself links to the findings list filtered to UNRATED, so opening the investigations from there is what populates their severities.
Once every cached investigation carries a severity, the tile disappears on its own.
Investigations by Entity Type
Every Detective investigation names the IAM principal it examined. This table, subtitled "Detective investigates IAM principals — select a type to open the matching investigations", breaks the cache down by the kind of principal. Its two columns are Entity type and Investigations, and its header chip counts the types present ("2 types").
| Row | Meaning |
|---|---|
| IAM role | The investigation examined an IAM role (IAM_ROLE) |
| IAM user | The investigation examined an IAM user (IAM_USER) |
The table shows the readable label; the raw token is what the row links with, so selecting IAM role opens the Findings page filtered to type=IAM_ROLE. A type AWS adds later that Prism does not have a label for is shown as its raw token rather than being guessed at or hidden.
Until the cache holds an investigation the table shows No entity types recorded yet, explaining that every investigation names the IAM role or user it examined and that types appear as soon as one is cached.
Investigations by Account
A table of every account with cached investigations, subtitled "Select an account to open the matching investigations", with Account and Investigations columns and a header chip reading "N accounts with investigations". Select an account row to open the Findings page filtered to that account.
Enrolled accounts with no investigations do not appear here — the table is built from the cached investigations, not from the enrolment list — so use Enrollment to see every enrolled account. With no investigations cached at all, the table shows No accounts with investigations.
Refreshing Investigations
Click Refresh investigations to fetch the latest investigations from AWS for every covered region. While it runs, the button reads Refreshing… and is disabled, its tooltip changes to "Refresh already in progress", and a progress panel appears beneath the header. The bar's label counts regions rather than naming them — "Scanned 2/4 regions · 17 investigations", with "· 1 region failed" appended if any could not be read — and a caption below it reads "N investigations fetched so far".
The refresh walks one region at a time. Progress is exact from the very first run, because the number of regions is known before the first AWS call is made.
A region that cannot be read does not fail the run, so a refresh can finish having covered less than it set out to. When that happens the completed run leaves a warning banner: "Refresh finished with gaps: N investigations fetched, X of Y regions could not be read. The counts below cover only what was read." A refresh that fails outright is reported as an error card with a retry, rather than silently leaving the old numbers in place.
The refresh reads the list of investigations, which is why severities arrive empty. Prism deliberately does not fetch each investigation's full report during a refresh: that would be one AWS call per cached investigation on every pass, against the single administrator principal that is Detective's whole rate budget. Severity is filled in per investigation as they are opened.
Empty States
The dashboard distinguishes three whole-page situations that look similar and mean different things. Each replaces the tiles and tables entirely; the header and the refresh button stay.
| State | What you see | What it means |
|---|---|---|
| Never refreshed | "No investigations loaded yet" — "Prism has not read your behavior graph yet. Refresh to pull the investigations Amazon Detective holds." — with a Refresh investigations button | Prism has not read your behavior graph yet |
| Refreshed, nothing found | "No investigations yet" with the explanation below and an Open the Detective console button | Prism looked and there is nothing to find, and there will not be until someone runs an investigation |
| Load failed | An error card with a Retry action | The request failed; this is not a configuration problem |
The first two are told apart by whether a refresh has ever completed, not by the absence of a timestamp — a refresh that found nothing leaves the cache just as empty as never having run.
The middle case is Detective's expected steady state, which is why it gets a full explanation rather than a bare "no results":
Amazon Detective is enrolled and ingesting data across N accounts and N regions. Detective does not create investigations on its own — it recommends entities worth investigating, and a report exists only once someone runs an investigation. Prism reads those reports; it does not start them. Run an investigation from the Amazon Detective console and it will appear here after the next refresh.
Its button opens the Amazon Detective console's front page. It is deliberately not a deep link: the state exists precisely because there is no investigation to link to.
See Detective does not create investigations on its own for the full explanation.
Two further empty states are scoped to a single table rather than the page, and they only appear on a dashboard that has other numbers to show: No entity types recorded yet and No accounts with investigations, described with their tables above.
Pressing Refresh investigations from either whole-page empty state shows the progress panel above the empty state, so the button visibly does something rather than appearing to be ignored.
A failed load never renders as "not configured". If the dashboard cannot reach the server you get an error card with a retry, not a setup wizard, so you are never invited to re-enable a capability that is already enabled and merely unreachable.
Related Pages
- Findings, Browse and filter the full investigation list
- Enrollment, Check which accounts are in the behavior graph
- Settings, Change regions or permissions
- Security Hub Issues, Troubleshooting refresh problems