c3.21 Investigate security incidents
When a finding fires, you need to reach the root cause fast — separating a false positive from a real incident, understanding the blast radius, and deciding what to contain. Build this investigation capability with correlated, ideally AI-assisted tooling; AWS offers several complementary options.
Implementation guidance
The capability, not a single tool
The goal of this control is the ability to investigate a security finding to its root cause: correlate signals across services, distinguish normal from anomalous behavior, understand the blast radius, and rule out false positives — quickly, so dwell time stays low. Several AWS services deliver this, and they are complementary rather than mutually exclusive:
- Amazon Detective — automatically correlates AWS CloudTrail, VPC Flow Logs, and GuardDuty findings into a linked, behavioral graph with geolocation and a baseline of normal activity, so analysts can trace an incident without building the pipeline themselves.
- Amazon GuardDuty investigation agent — on-demand, AI-powered threat assessment that investigates a finding and summarizes what happened.
- AWS Security Incident Response — combines automated triage with an AI-powered investigation agent and 24/7 access to the AWS Customer Incident Response Team (CIRT) for active events.
- AWS Security Hub — correlates and prioritizes findings across services into exposures, and can feed AI-assisted investigation workflows.
Many teams also investigate from a third-party SIEM / SOAR. What matters for alignment is that the capability exists and is fast, not which product provides it.
What a good investigation answers
- Is this activity anomalous versus the resource's normal pattern, and from expected locations?
- What is the blast radius, and what is the true root cause versus a false positive?
- What must be contained now, and what evidence must be preserved?
Watch
How to validate
- Do you have a capability to investigate a finding to root cause by correlating signals across services (CloudTrail, VPC Flow Logs, GuardDuty, and more)?
- Can analysts distinguish normal from anomalous behavior and determine the blast radius?
- Are findings from GuardDuty / Security Hub routed into investigation quickly, and do responders know how to engage AWS Security Incident Response / CIRT for an active event?
- Are investigation outputs preserved as evidence and fed into your response process?
Threats addressed
- Without a fast, correlated investigation capability, analysts stitch logs together by hand, false positives consume effort, and the true root cause is found late — extending dwell time and impact.
AWS services
Amazon Detective 
AWS Security Hub 
AWS Security Incident Response Pricing
Varies by tool. For example, Amazon Detective offers a 30-day free trial and includes recent historical data from activation. See Amazon Detective pricing.