AWS Detective Graph Deleted

Last updated 13 days ago on 2026-08-14

Created 13 days ago on 2026-08-14

About

Detects the deletion of an Amazon Detective behavior graph via the DeleteGraph API. Amazon Detective automatically collects log data from AWS services and uses machine learning, statistical analysis, and graph theory to build an interactive model of resource behaviors and interactions. Deleting a behavior graph destroys its historical analysis data and removes the ability to investigate security incidents using Detective's relationship mapping. An attacker with sufficient IAM permissions may delete the Detective graph to impair forensic investigation of a compromise.

Tags

Domain: CloudPlatform: AWSData Source: AWS CloudTrailService: AWS DetectiveRule Type: Custom Query (KQL)Tactic: Defense EvasionLanguage: kuery

Severity

low

Risk Score

MITRE ATT&CK™

Defense Evasion (TA0005)(external, opens in a new tab or window)

↳ Impair Defenses (T1562)(external, opens in a new tab or window)

False Positive Examples

Legitimate decommissioning of an AWS account, regional consolidation, or removal of an unused Detective deployment may trigger this rule. Validate the caller identity and confirm a corresponding change management ticket exists before closing.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: Query (Kibana Query Language)
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-aws.cloudtrail-*
Related Integrations: aws(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗data_stream.dataset: "aws.cloudtrail"
    and event.provider: "detective.amazonaws.com"
    and event.action: "DeleteGraph"
    and event.outcome: "success"

Install detection rules in Elastic Security

Detect AWS Detective Graph Deleted in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).