Individual skill
performing-cloud-native-threat-hunting-with-aws-detective
Hunt for threats in AWS environments using Detective behavior graphs, entity investigation timelines, GuardDuty finding correlation, and automated entity profiling across IAM users, EC2 instances, and IP addresses.
internal/tools/skills/data/threat-hunting/performing-cloud-native-threat-hunting-with-aws-detective/SKILL.md
Source commit d42f381ad34843e71a42658e5c57290c713e85af
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Not checked yet
- Last checked
- Nov 7, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 1,313
- Repository last updated
- Nov 7, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- cybersecurity Repository topic
- security Repository topic
- bug-bounty Repository topic
- automation Repository topic
- autonomous-pentesting Repository topic
- ai-agent Repository topic
- ai-security Repository topic
- ethical-hacking Repository topic
- golang Repository topic
- penetration-testing Repository topic
- aws-detective Declared skill tag
- threat-hunting Declared skill tag
- cloud-security Declared skill tag
- guardduty Declared skill tag
- behavior-graph Declared skill tag
- aws Declared skill tag
- iam Declared skill tag
- ec2 Declared skill tag
- incident-investigation Declared skill tag
- security Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
Read excerpt
# Performing Cloud-Native Threat Hunting with AWS Detective
## Overview
AWS Detective automatically collects and analyzes log data from AWS CloudTrail, VPC Flow Logs, GuardDuty findings, and EKS audit logs to build interactive behavior graphs. These graphs enable security analysts to investigate entities (IAM users, roles, IP addresses, EC2 instances) across time, identify anomalous API calls, detect lateral movement between accounts, and correlate GuardDuty findings into coherent attack narratives — all without manual log parsing.
## Detection Gaps & Validation
- **No retroactive visibility:** Detective only analyzes data from when it (and GuardDuty, 48h+) was enabled, with a rolling ~1-year retention. Activity before enablement never appears - confirm the behavior graph's data range covers the incident before concluding nothing happened earlier.
- **Per-account / per-region graphs:** an attacker operating in a region or member account where Detective isn't enabled is invisible. Verify coverage with `aws detective list-graphs` in each region and confirm member accounts are enrolled under the admin account.
- **Source coverage excludes S3 data events:** Detective ingests CloudTrail management events, VPC Flow Logs, GuardDuty findings, and EKS audit logs - not S3 object-level data events. Pivot to S3 access logs / Athena to confirm or rule out data exfiltration.
- **Scope Time hides slow attacks:** the default 24h window misses low-and-slow campaigns. Widen Scope Time toward the 1-year max and re-profile the entity before clearing it.
- **Indicators are heuristics, not verdicts:** `IMPOSSIBLE_TRAVEL`, `NEW_GEOLOCATION`, `NEW_ASO`, and `NEW_USER_AGENT` produce false positives (VPNs, travel, new tooling). Validate each against raw CloudTrail (`sourceIPAddress`, `userAgent`, `sessionContext`) before escalating.
- **No GuardDuty finding = nothing to correlate:** Detective enriches GuardDuty; if the relevant detector or finding type is disabled, the campaign won't surface as a finding group. Confirm GuardDuty coverage for the IAM/EC2/EKS finding types in scope.