Once GuardDuty says "something is wrong," the next question is always the same: "Is it really a breach? How far has it spread? How did it start?" This investigation phase is Amazon Detective's domain. If GuardDuty is detection, Detective is investigation — it takes one finding and visualizes all surrounding behavior, tracking root cause and blast radius.
Detective's core is "replacing the analyst's manual SQL slog of stitching scattered logs with an automatically built behavior graph." In incident investigation, the most expensive resource is analyst time