Nimbus Games has Amazon GuardDuty and Amazon Detective already enabled across all accounts. A GuardDuty finding indicates Backdoor:EC2/C&CActivity.B on an instance role. The IR lead wants to quickly understand the related API calls made by that role, recent network peers, and failed versus successful connections without building custom queries. What should the lead use first?

Amazon Detective is designed to automatically collect and analyze security-related data from services like GuardDuty, CloudTrail, and VPC Flow Logs. When a GuardDuty finding occurs, Detective allows you to pivot directly from the finding to an entity profile (like the affected EC2 instance or role). This profile provides a pre-built, interactive visualization of related API calls, network connections, and other activities over a customizable time window, precisely addressing the IR lead's need for quick insights without custom queries. Incorrect options: AWS Security Hub insights primarily aggregate findings and provide high-level overviews; it does not offer the deep, interactive investigative capabilities of Detective for correlating multiple data sources without custom queries. Creating a CloudTrail Lake event data store and querying Athena for VPC Flow Logs would require significant manual effort, custom query building, and correlation, which the lead explicitly wants to avoid. AWS Config resource timelines track configuration changes and related events, but they do not provide the integrated security investigation capabilities for API calls, network peers, and connection success/failure that Detective offers.