Run an Investigation and Collect Indicators
A 3-step recipe with Amazon Detective. We can help you get access.
Recipe · 3 steps
Run an Investigation and Collect Indicators
with Amazon Detective
Start an investigation, poll to completion, and list the resulting indicators.
- Initiate a Detective investigation on the target entity within the behavior graph and capture the returned investigation ID.
- Fetch the current investigation results. While the status is still RUNNING the step loops back on itself; once the status is SUCCESSFUL it proceeds to collect indicators, and on FAILED it ends the workflow.
- Retrieve the indicators of compromise surfaced by the completed investigation, optionally narrowed by indicator type.
What you'll need to have ready
- graphArn: The ARN of the behavior graph to investigate within.
- entityArn: The ARN of the IAM user or IAM role entity to investigate.
- scopeStartTime: The start of the investigation scope window (ISO 8601 date-time).
- scopeEndTime: The end of the investigation scope window (ISO 8601 date-time).
- indicatorType: Optional indicator type used to filter the listed indicators.
For your developer
Arazzo workflow amazon-detective:run-investigation, 3 operations: StartInvestigation → GetInvestigation → ListIndicators. Specs on APIs.io.