A video streaming platform running on Amazon EKS at large scale is experiencing unauthorized logins and sudden user logouts. The company wants stronger platform-wide security, a summarized view of resource behaviors and interactions across the AWS environment (login attempts, API calls, network traffic), the ability to analyze network traffic while minimizing log management overhead, and fast investigation of potential malicious activity related to the EKS workload. Which solution meets these needs?

The correct solution leverages GuardDuty EKS Protection for threat detection, identifying unauthorized logins and suspicious EKS activity. Amazon Detective then provides a summarized, interactive view of resource behaviors and interactions by automatically collecting and analyzing logs from GuardDuty (including EKS audit logs), CloudTrail, and VPC Flow Logs. Enabling EKS audit logs as an optional source package in Detective allows for deeper investigation into EKS-specific malicious activity, offering fast and efficient forensic analysis without manual log management. The other options are less comprehensive or efficient. Storing logs in S3 and querying with Athena/QuickSight provides analysis but lacks the automated threat detection and interactive investigation capabilities of GuardDuty and Detective. CloudWatch Container Insights focuses on performance metrics, not security threat detection or forensic analysis. While VPC Flow Logs are useful, they don't provide the integrated security analysis needed for EKS-specific threats and overall behavioral analysis that Detective offers.