The THREAT HUNTER of your Cloud - Amazon Detective
Tags: security, cloud, cybersecurity, productivity
Published: 2022-04-01 01:45:17

## DAY 25 - THE THREAT HUNTER OF CLOUD - Day Twenty Five

[![Image tweet](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jfjzxg64r7q0i8ra6b8t.png)![Image cover](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/z30mo5sbn22l1bh7j6he.jpg)](https://twitter.com/intent/tweet?text=The%20THREAT%20HUNTER%20of%20your%20Cloud%20%2C%20a%20blog%20by%20%40anuvindhs%0A%23security%20%23cloud%20%23automation%20%23threat%20%23hunting%0A%0Ahttps%3A%2F%2Fdev.to%2Faws-builders%2Fthe-threat-hunter-of-your-cloud-36me%20)


[100 days of Cloud on GitHub](https://github.com/anuvindhs/100daysofcloud) - [Read On iCTPro.co.nz](https://ictpro.co.nz) - [Read on Dev.to](https://dev.to/anuvindhs)



------




- Collect logs from AWS resources
- use Machine Learning , Statistical analysis and graph theory.
- Detect and investigate threats

A fast and effective way to identify a root cause for security issues. Detective can process terabytes of data and comes with data visualization of the vast information from the report.

## AMAZON Detective
![Image pickchu](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4u624upzydcadel86tm7.gif)
### How to ?

- Enable Amazon Detective from the console
- The Data will be automatically organized into graph model. - investigate using **GaurdDuty** and **AWS Security Hub**, **Amazon Macie**.
- Find the Cause using interactive visualizations.

#### Lets talk a bit about Amazon GuardDuty


![Image gaurdduty](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xa3u5cclgro7jcsp1dug.gif)
Its a treat detection service from AWS Which continuously **monitors malicious activity**. This is done with the help of **Machine Learning** & **Anomaly detection**.
Data's from **CloudTrail, VPC flow logs, DNS logs** are used for **analysis** to provide **graph view**.

 **_GaurdDuty have to enabled and wait for 48 hours to enable the Detective_**

### Why should we use ?

- **Investigate**, determine the cause related to incidents.
- **Triage**, determine who should look into it.
- **Threat Identification** , detailed understanding to identify threat.

### Cost ?

- **Free** for 30 days
- Check out this [link](https://aws.amazon.com/detective/pricing/) to understand more about the Detective Pricing on each region.

![Image budget](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/b3mxkf39w3yrimds9zfe.gif)

Works with Services
CloudTrail (AWS api calls), VPC flow logs (traffic on VPC) 

## Terminologies

- Behavior graph - Generated from incoming data with the account
- Detective source Data - information on AWS Flowlogs, CloudTrail and GaurdDuty Findings.
- Entity - Extracted from source data.
- Finding - issues found by guard duty.
- Investigation - Finding out root cause for issue.
- Profile -  Visualizations and supporting information.
- Profile Panel - Visualization on profile.
- Relationship -  what's happening with two individual resources. or how they are related.

You can use a **primary account** to collect all data to create graph from **secondary account**.  Secondary account will only have data that contributed to primary account.

### Important links
- [Amazon Detective User Guide](https://docs.aws.amazon.com/detective/latest/userguide/detective-ug.pdf)
- [Amazon Detective FAQs](https://aws.amazon.com/detective/faqs/)
- [Amazon Detective Documentation](https://docs.aws.amazon.com/detective/?id=docs_gateway)
- [GuardDuty finding types](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-active.html)


 ----------

**✅Connect with me on [Twitter](https://twitter.com/intent/follow?ref_src=anuvindhs&screen_name=anuvindhs)
 🤝🏽Connect with me on [Linkedin](https://www.linkedin.com/in/anuvindhs)
🧑🏼‍🤝‍🧑🏻 Read more post on [dev.to](https://dev.to/anuvindhs) or  [iCTPro.co.nz](https://ictpro.co.nz)
💻 Connect with me on [GitHub](https://github.com/anuvindhs)**


{% user anuvindhs %}