After GuardDuty flags cryptocurrency mining on an EC2 instance, the IR team must determine the initial access vector, lateral movement, and whether other accounts were touched during a 14-day window. VPC flow logs and CloudTrail are voluminous. Which method should the responder use to conduct root cause analysis?
Select an answer to reveal the explanation.
Short Explanation
Raw logs can feel like a haystack when you need the thread. You’ll save time with Detective, which correlates findings and activity in a visual timeline.
Full Explanation
Amazon Detective is correct because it is purpose-built for root cause analysis after a finding: it automatically correlates GuardDuty findings with CloudTrail API calls, VPC flow logs, and EKS audit data in entity-centered profiles and time-ordered timelines. This helps you investigate initial access, lateral movement, and cross-account activity without manually joining voluminous logs, and its history covers the 14-day window. Amazon Security Lake with Athena can centralize the relevant multi-account CloudTrail and VPC flow logs, but it is a queryable data lake: you must write SQL and manually connect IPs, ARNs, and timestamps rather than use a prebuilt finding timeline. AWS CloudTrail Lake can query API history across accounts to investigate management activity, but that telemetry alone lacks VPC flow evidence for instance-to-instance movement or mining egress. VPC Flow Logs with CloudWatch Logs Insights can filter network connections and reveal lateral traffic, but they lack CloudTrail identity context to show how credentials were obtained or whether other accounts were assumed. Exam caveat: correlated activity helps guide the investigation, but a timeline is not by itself proof of causation. Practical check: open Detective’s finding group for the mining instance, pivot through its 14-day IP and IAM role activity, and verify the related API calls and flow connections.