AWS Detective Graph Deleted

ELASTIC detection rule by Elastic · Elastic License v2

Detects the deletion of an Amazon Detective behavior graph via the DeleteGraph API. Amazon Detective automatically collects log data from AWS services and uses machine learning, statistical analysis, and graph theory to build an interactive model of resource behaviors and interactions. Deleting a behavior graph destroys its historical analysis data and removes the ability to investigate security incidents using Detective's relationship mapping. An attacker with sufficient IAM permissions may delete the Detective graph to impair forensic investigation of a compromise.

[metadata]
creation_date = "2026/08/14"
integration = ["aws"]
maturity = "production"
updated_date = "2026/08/14"

[rule]
author = ["Elastic"]
description = """
Detects the deletion of an Amazon Detective behavior graph via the DeleteGraph API. Amazon
Detective automatically collects log data from AWS services and uses machine learning, statistical
analysis, and graph theory to build an interactive model of resource behaviors and interactions.
Deleting a behavior graph destroys its historical analysis data and removes the ability to
investigate security incidents using Detective's relationship mapping. An attacker with sufficient
IAM permissions may delete the Detective graph to impair forensic investigation of a compromise.
"""
false_positives = [
    """
    Legitimate decommissioning of an AWS account, regional consolidation, or removal of an unused
    Detective deployment may trigger this rule. Validate the caller identity and confirm a
    corresponding change management ticket exists before closing.
    """,
]
from = "now-6m"
index = ["logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS Detective Graph Deleted"
note = """## Triage and analysis

### Investigating AWS Detective Graph Deleted

Amazon Detective builds a behavior graph from CloudTrail, VPC Flow Logs, and GuardDuty findings, enabling investigation teams to trace the full scope and timeline of a security incident. `DeleteGraph` is a rare, irreversible operation — the historical graph data cannot be recovered after deletion. An adversary who deletes the Detective graph removes a key forensic investigation tool, making it harder to understand the scope of a compromise.

### Possible investigation steps

- Identify the caller in `aws.cloudtrail.user_identity.arn` and `user.name`. Confirm whether this is an authorized cloud administrator or an anomalous identity.
- Check whether the deletion was preceded by other defense-evasion actions in the same time window: GuardDuty detector deletion, CloudTrail StopLogging, Security Hub disable.
- Determine how long the Detective graph had been active and what historical data was lost.
- Review all IAM actions by this identity in the 24 hours before the deletion.

### False positive analysis

- Account decommissioning workflows may include Detective graph deletion as part of teardown. Verify via change management records.

### Response and remediation

- Re-enable Amazon Detective for the affected account and region.
- Reconstruct investigation context from raw CloudTrail, VPC Flow Logs, and GuardDuty findings.
- Revoke active sessions for the deleting identity if the action was unauthorized.
- Add an SCP restricting `detective:DeleteGraph` to break-glass administrator roles.
"""
references = [
    "https://docs.aws.amazon.com/detective/latest/APIReference/API_DeleteGraph.html",
]
risk_score = 21
rule_id = "fa0177e5-b065-444a-a94e-872cbb28ffee"
setup = "The AWS integration must be ingesting management events into `logs-aws.cloudtrail-*`. Amazon Detective must be enabled in the account for this event to appear."
severity = "low"
tags = [
    "Domain: Cloud",
    "Platform: AWS",
    "Data Source: AWS CloudTrail",
    "Service: AWS Detective",
    "Rule Type: Custom Query (KQL)",
    "Tactic: Defense Evasion",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "detective.amazonaws.com"
    and event.action: "DeleteGraph"
    and event.outcome: "success"
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "user.name",
    "event.action",
    "event.outcome",
    "source.ip",
    "cloud.region",
    "cloud.account.id",
]

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

8a00a91b-23b1-42ff-ab5c-0507d1489b94

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion