AmazonDetective.yaml

version: 1
ATT&CK version: 9
creation date: 06/14/2021
name: Amazon Detective
contact: ctid@mitre-engenuity.org
organization: Center for Threat Informed Defense (CTID)
platform: AWS
tags:
  - Not Mappable
description: >-
  Amazon Detective is an automated data enrichment tool that extracts time-based events from other
  services such as AWS CloudTrail, Amazon VPC flow logs, and GuardDuty.

  These events include: login attempts,  API calls,  and network traffic and can be very useful
  in understanding security issues or operational account activity. Amazon Detective uses machine learning,
  statistical analysis, and graph theory to help you visualize and conduct faster and more efficient
  security investigations.
techniques: []
comments: >-
  Although this service can be scored as a Response control (Minimal/Data Enrichment/Forensics),
  due to the generic nature of its functionality, currently it does not look to be reasonably
  mappable to specific (sub-)techniques of MITRE ATT&CK.
references:
  - https://aws.amazon.com/detective/
  - https://aws.amazon.com/detective/faqs/
  - https://docs.aws.amazon.com/detective/latest/adminguide/what-is-detective.html