[アップデート] Amazon GuardDuty Investigation (Preview) で、調査が結論に至るまでの過程をレコードとして取得できるようになりました

> aws guardduty update-detector \
    --detector-id $DETECTOR_ID \
    --features '[{"Name": "AI_ANALYST", "Status": "ENABLED"}]'

> aws guardduty create-investigation \
    --detector-id $DETECTOR_ID \
    --trigger-prompt "Investigate finding $FINDING_ID in account $ACCOUNT_ID"

{
    "InvestigationId": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111"
}

> aws guardduty get-investigation \
    --detector-id $DETECTOR_ID \
    --investigation-id $INVESTIGATION_ID \
    --query 'Investigation.{Status:Status,RiskLevel:RiskLevel,Confidence:Confidence,StartTime:StartTime,EndTime:EndTime}'

{
    "Status": "COMPLETED",
    "RiskLevel": "Info",
    "Confidence": "High",
    "StartTime": "2026-11-13T09:13:52.859000+09:00",
    "EndTime": "2026-11-13T09:20:17.908000+09:00"
}

> aws guardduty list-investigation-records \
    --detector-id $DETECTOR_ID \
    --investigation-id $INVESTIGATION_ID \
  | jq -r '.Records[] | "\(.CreatedAt)\t\(.Type)\t\(.Title)"'

2026-11-13T09:14:16.120000+09:00	UPDATE	User Request
2026-11-13T09:14:16.121000+09:00	UPDATE	Assistant Response
2026-11-13T09:14:23.883000+09:00	FETCH	Fetching Finding
2026-11-13T09:14:24.396000+09:00	FETCH	Fetching Detector details
2026-11-13T09:14:28.676000+09:00	FETCH	Fetching Finding Type Documentation
2026-11-13T09:14:31.749000+09:00	OBSERVATION	EC2 Instance Details
2026-11-13T09:15:11.322000+09:00	OBSERVATION	No Related Findings Correlated to Instance Credential Exfiltration
2026-11-13T09:15:11.323000+09:00	ANALYSIS	Threat Assessment: Instance Credential Exfiltration Outside the Instance
2026-11-13T09:18:42.590000+09:00	ANALYSIS	Credential Exfiltration Vector Analysis (InsideAWS)
2026-11-13T09:18:54.780000+09:00	ANALYSIS	Post-Exfiltration Activity Pattern
2026-11-13T09:19:27.582000+09:00	OBSERVATION	CloudTrail Session Activity
2026-11-13T09:19:27.583000+09:00	ANALYSIS	API Activity and Persistence Analysis
2026-11-13T09:19:27.584000+09:00	OBSERVATION	Impacted Resources
2026-11-13T09:19:43.036000+09:00	OBSERVATION	EC2 instance credentials used from an unaffiliated AWS account (sample finding)
2026-11-13T09:19:43.036000+09:00	OBSERVATION	Detection coverage for account 123456789012
2026-11-13T09:20:34.364000+09:00	METADATA	Investigation Metadata

> aws guardduty list-investigation-records \
    --detector-id $DETECTOR_ID \
    --investigation-id $INVESTIGATION_ID \
    --record-types OBSERVATION ANALYSIS \
  | jq '.Records | length'

10

Three correlation queries were run over the wide window of 2026-09-21T23:27:52Z to 2026-10-05T23:27:52Z
(±7 days around the primary's updatedAt): (1) same_behavior on remote IP 198.51.100.0 ...,
(2) same_resource on EC2 instance i-99999999 ..., and (3) same_resource on IAM access key
GeneratedFindingAccessKeyId .... All three queries returned zero results.

{
    "RecordId": "a1b2c3d4-5678-90ab-cdef-EXAMPLE22222",
    "Type": "OBSERVATION",
    "Title": "Detection coverage for account 123456789012",
    "Narrative": "CloudTrail management events, S3 data events, VPC Flow Logs, DNS logs, EKS Audit Logs, Lambda network logs, RDS login events, EBS Malware Protection and Runtime Monitoring are enabled. Automated agent management for EC2 and ECS Fargate is disabled, and EKS Runtime Monitoring is disabled.",
    "CreatedAt": "2026-11-13T09:19:43.036000+09:00",
    "SupportingData": {
        "Observation": {
            "ObservationType": "DETECTION_COVERAGE",
            "DetectionCoverage": {
                "ProtectionPlans": [
                    {
                        "Name": "CLOUD_TRAIL",
                        "Status": "ENABLED"
                    },
                    {
                        "Name": "EC2_AGENT_MANAGEMENT",
                        "Status": "DISABLED"
                    },
                    {
                        "Name": "RUNTIME_MONITORING",
                        "Status": "ENABLED"
                    }
                ],
                "FoundationalDataSources": [
                    "CLOUD_TRAIL",
                    "DNS_LOGS",
                    "FLOW_LOGS"
                ],
                "KeyObservation": "This finding comes from CloudTrail management events, which are enabled, so the core detection for credential misuse is in place. Runtime Monitoring is enabled, but EC2 automated agent management is disabled. Unless the GuardDuty agent was installed by hand on instance i-99999999, there may be no host-level view of how the credentials were pulled from the instance, such as a process calling the instance metadata service. VPC Flow Logs and DNS logs are enabled and give network context for the instance."
            }
        }
    }
}

> aws guardduty list-investigation-records \
    --detector-id $DETECTOR_ID \
    --investigation-id $INVESTIGATION_ID

{
    "Records": [],
    "Status": "RUNNING",
    "InvestigationId": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111"
}