Detective in the real world
To understand the practical application of Detective, let’s consider its use in the following scenario.
Scenario
Imagine a global media company that streams content to millions of users worldwide using AWS for its content delivery network, user authentication, and analytics. Suddenly, they started noticing an abnormal spike in failed login attempts and a simultaneous increase in data transfer costs. Concerned about a potential security breach, they turn to Detective for deeper insights.
Solution
Upon activation, Detective started its data correlation process, pulling in information from GuardDuty, CloudTrail, and VPC flow logs. The service’s ML algorithms quickly identified that the failed login attempts were part of a coordinated effort originating from multiple geographic locations. It also detected the abnormal data transfer to the suspicious S3 bucket. Detective grouped these findings and mapped them to the MITRE ATT&CK framework, providing the security team with a comprehensive view of the threat landscape.
Outcome
Armed with this information, the security team took several immediate actions:
- Multi-factor authentication was enforced for all high-profile content creators
- The suspicious S3 bucket was isolated, and its access permissions were revoked
- Network access controls were tightened to block the IP ranges from which the failed login attempts originated
Detective’s advanced correlation techniques were instrumental in identifying the complex attack pattern, enabling the media company to thwart a potentially damaging content leak and unauthorized access to creator accounts.
Who should use Detective?
Detective is particularly beneficial for:
- Large enterprises: Given its advanced correlation techniques and the depth of analysis it offers, Detective is well-suited for large enterprises with complex AWS environments.
- E-commerce platforms: These businesses often have to deal with a high volume of transactions and customer data, making them prime targets for various types of cyberattacks. Detective can help in quickly identifying and mitigating these threats.
- Managed service providers: For those who manage multiple AWS accounts, Detective provides a unified view of all security events, making it easier to monitor and respond to incidents.