Detective
- Threat detection, continuously monitors for malicious and unauthorized activity
- Uses CloudTrail, VPC Flow, and GuardDuty findings
- Pricing based on GB ingest volume per region
- Search by IP, role, etc. and shows API calls by user/resource/service and their status