Posted On: Oct 17, 2022
Starting today, Amazon Detective automatically groups related GuardDuty findings to help security analysts reduce triage time and create a more comprehensive security investigation. Detective uses machine learning (ML) to group related GuardDuty findings that in isolation may have been ignored but together show the lifecycle of an attack, which can help security analysts identify advanced threats more easily. Available under the Summary page, Detective shows groups of related GuardDuty findings with severity, all affected AWS accounts, and resources. In addition, Detective maps the evolution of findings to tactics, techniques, and procedures (TTP) from the MITRE ATT&CK framework - a well adopted framework for security and threat detection.
There is no additional charge for this new feature, and it’s available today for existing and new Detective customers in all AWS Regions that support Detective. To learn more, see the Amazon Detective User Guide or get started with a 30-day free trial.