AWS offers services like Amazon GuardDuty, Amazon Detective, and AWS Security Hub that enable automated monitoring, investigation, and security posture management, helping reduce the time to detect and respond to potential threats.

<div>
<p>This article discusses how to use the Amazon Detective API to investigate GuardDuty security findings and enrich data in Security Hub.</p>
<p>Specifically, the article covers:</p>
<ul>
<li>Solution architecture integrating GuardDuty, Security Hub, EventBridge, Lambda, and Detective</li>
<li>Using the Detective API and a JavaScript Lambda function to perform investigations and enrich findings</li>
<li>Setting up automated investigations for high severity GuardDuty findings using Security Hub automations</li>
<li>Enabling on-demand investigations using Security Hub custom actions</li>
<li>Limitations and potential customizations of the provided solution</li>
</ul>
</div>


How to use the Amazon Detective API to investigate GuardDuty security findings and enrich data in Security Hub

Related articles

Related articles

Sep 18
2024
Using Amazon Detective for IAM investigations

Dec 2
2024
Amazon GuardDuty introduces GuardDuty Extended Threat Detection

Jun 4
2025
Detect and investigate Amazon EC2 malware with Amazon GuardDuty and Amazon Detective

Sep 15
2025
Navigating Amazon GuardDuty protection plans and Extended Threat Detection