Skip to main content

Findings

The Findings page lists the Amazon Detective investigation reports stored in Prism from the last refresh. You can filter by account, severity and status, search by title, and open any investigation to see the IAM principal it examined, the analysis run, the window it covered, and a link into the Amazon Detective console.

Accessing Findings​

In the Security Hub sidebar, click Amazon Detective > Findings. You can also reach this page pre-filtered by clicking a severity tile, the Unrated tile, an entity-type row, or an account row on the Dashboard.

Detective investigations also appear in the unified Security Hub findings inbox alongside CSPM, GuardDuty, Macie and Inspector findings, where an extra Engine column tags each row Amazon Detective. This page is that same inbox scoped to Detective, so the two always agree about what an investigation looks like.

The page header reads Findings, with Detective investigations and a running count beside it, for example Detective investigations • 50+ shown. The + means more rows are available than have been loaded.

info

The list shows results from the last refresh, not live AWS data. If it appears stale, run Refresh investigations from the Dashboard.

Detective Findings Are Investigations​

Detective's findings are not posture or vulnerability findings like the other engines'. Each row is an investigation report: a record that somebody asked Amazon Detective to analyse one IAM principal over one time window, and what Detective concluded.

Two consequences follow, and both are the most common source of confusion on this page:

  1. The list is empty until an investigation is run. Detective does not create investigation records on its own, and Prism never starts one. The empty state on this page carries the same explanation as the dashboard, because you can land here first. See Detective does not create investigations on its own.
  2. An investigation can be unrated. Severity arrives with the full report, not with the list, so a freshly refreshed investigation has no severity until it is opened. See The Unrated tile.

Findings Table​

Each row represents one investigation:

ColumnDescription
SeveritySeverity chip: CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL, or Unrated in a neutral colour when Detective has assigned none
TitleThe investigation, identified by the IAM entity examined; truncated to one line, with the full title on hover
Resource typeThe kind of principal investigated, IAM_ROLE or IAM_USER. The entity's full ARN is not in the table; it is in the detail drawer
AccountThe AWS account the investigated principal belongs to
RegionThe region whose behavior graph holds the investigation
StatusActive or Archived
Last observedWhen the investigation was created or last updated, in your browser's local time

Click any row to open the investigation detail drawer.

The list loads 50 investigations at a time. When more are available a Load more button appears beneath the table and appends the next page rather than replacing the current one.

Filtering​

Use the filter controls above the table to narrow the list. The Filters card is headed Narrow the list by account, severity or status and shows an N active chip once anything is set.

  • Account: a dropdown listing the accounts enrolled in Detective, labelled Name (123456789012); it defaults to All accounts. Accounts that are disabled or being removed are not offered
  • Search title: free-text search against the investigation title
  • Severity: toggle chips for CRITICAL, HIGH, MEDIUM, LOW and INFORMATIONAL, combined with OR
  • Status: toggle chips labelled Active and Archived
  • Entity type: there is no chip row for this one. It is applied when you arrive from an entity-type row on the Dashboard, and appears as a removable Entity type: IAM_ROLE chip above the filter groups

Any filter that has no chip of its own is surfaced the same way, as a removable chip that names it, so a filtered list can never look unfiltered. A Clear filters (N) button appears in the page header while anything is set, and all of the filters are reflected in the page URL, so a filtered view can be shared or bookmarked.

note

Detective's severity vocabulary is exactly Critical, High, Medium, Low and Informational. There is no UNTRIAGED chip here, unlike Inspector, because Detective never emits that value.

Unrated investigations are reached from the Unrated tile on the Dashboard, which links to this page with severity=UNRATED. UNRATED is Prism's own token, never sent to AWS: it selects the investigations whose severity is empty. Because it is not one of the five chips, it shows up here as a removable Severity: UNRATED chip.

When the List Is Empty​

Two different empty states appear here, and they mean different things:

WhenWhat you see
One or more filters are activeNo findings match these filters — Clear a filter or widen the search to see more findings.
No filters are activeNo investigations yet, with the full explanation below and an Open the Detective console button

Amazon Detective does not create investigations on its own — it recommends entities worth investigating, and a report exists only once someone runs an investigation. Prism reads those reports; it does not start them. Run an investigation from the Amazon Detective console and it will appear here after the next refresh.

The second case is Detective's expected steady state, not a fault, which is why it gets an explanation rather than a bare "no results". A filtered empty list always means "widen the filter", so the explanation is deliberately not shown in that case.

Investigation Detail​

Selecting an investigation opens a detail drawer on the right-hand side of the screen.

Its header carries the investigation's title, its severity chip (or Unrated), and a single state chip reading Active or Archived. That chip is the investigation's record state, never its analysis run — see the warning below.

Overview​

Repeats the severity and the raw record state as chips, shows the investigation's description when Detective supplied one, and then:

FieldDescription
Investigation IDDetective's identifier for the report
AccountThe AWS account the investigation belongs to
RegionThe region whose behavior graph holds it
First seenWhen Prism first observed the investigation
Last seenWhen the investigation was last updated

Entity​

FieldDescription
Entity typeIAM_ROLE or IAM_USER
EntityThe ARN of the IAM role or user the investigation examined

Either row is omitted entirely when the value is absent, rather than rendering an empty field.

Analysis Run​

Shown only when Detective reported a run status or a complete scope window. It opens with a sentence separating the two axes:

How far Detective's analysis of this entity got. This is not the investigation's state — a running investigation is still active.

FieldDescription
Run statusHow far Detective's analysis got: Running, Successful or Failed. A value AWS adds later is shown verbatim in a neutral chip rather than being forced into one of the three
Scope windowThe time window the investigation analysed, rendered as start → end
warning

The analysis run and the investigation's state are different things and are shown separately. The run status describes whether Detective's run over the behavior graph completed. The state (Active or Archived) describes how the investigation has been triaged. A successful analysis on an archived investigation is an ordinary combination, and a Running investigation is still an Active one.

The scope window row is omitted entirely unless Prism has both ends of it, rather than showing a partial or placeholder window. In practice the report is fetched on the same click that opens the drawer, so a populated window is the normal case; an absent one means the fetch was throttled, the investigation no longer exists, or the region's graph could not be resolved.

Severity is shown as an explicit Unrated chip in a neutral colour when Detective has not assigned one, never folded into Informational. The list cell, the drawer header and the dashboard tile all use that same one word, so they cannot disagree about what a blank severity means.

Amazon Detective Console​

The last section links out to AWS, because the full indicator list and every response action live there:

The full indicator list, and any action on this investigation, live in the Amazon Detective console. AWS publishes no direct URL for a single report — open Investigations in the console and select ID <investigation ID>.

note

There is no direct link to a single investigation. AWS documents no per-investigation console URL, so the link — Open Amazon Detective (region) — opens the Detective console for the investigation's own region, and the copy above it names the ID to select once you are there. The region matters: a behavior graph is per-region, and an investigation belongs to exactly one graph.

A Next steps section appears beneath it when AWS supplied remediation guidance for the investigation, with a Read the AWS guidance link.

info

Detective investigations are read-only in Prism. There is no archive, unarchive or suppress action, and no save button at all, because Prism does not carry the permission to change an investigation's state. The drawer's footer says so, above a single Close button:

Investigation state is managed in the Amazon Detective console. Prism reads investigations and does not change them.

Archive or re-triage an investigation in the AWS console, and the change appears in Prism after the next refresh.