After GuardDuty alerts on unusual API calls from a finance analyst's credentials, the IR team must map accessed S3 buckets, EC2 instances, and IP history to find how the credentials were abused. Which root cause analysis method reconstructs the attack timeline fastest?
Select an answer to reveal the explanation.
Short Explanation
You're looking for the story behind the alert, not just the alert itself. Detective's linked graph brings users, IPs, and resources together on a timeline so you can trace the abuse.
Full Explanation
Amazon Detective is correct because it natively brings GuardDuty findings together with CloudTrail and VPC Flow Logs in a precomputed entity graph. The graph links the user, role session, IP addresses, S3 buckets, and EC2 instances on an interactive timeline, helping you see the credential-abuse path and IP history without manual joins, so it is the fastest method here. Querying CloudTrail Lake with SQL is useful for precise API forensics, but its raw events require manual filtering and correlation and do not provide a unified user-IP-resource visualization; CloudTrail Lake is also closed to new customers. Triaging the GuardDuty finding in Security Hub by joining CloudTrail events and VPC Flow Logs is a valid centralized SOC workflow, but manual pivots across formats take longer and do not automatically reconstruct temporal relationships. Reviewing AWS Config and IAM Access Analyzer histories can show configuration changes and permission breadth for buckets and instances, but does not show the sequence of API calls or network source history needed for this timeline. An exam caveat: do not confuse a configuration timeline with an API activity timeline; API activity shows how credentials were used. As a practical check, confirm Detective is enabled in the affected Region and has sufficient graph retention, then pivot from the GuardDuty finding into profile views to verify the IPs and resources before containment.