Amazon Web Services → Microsoft Azure
Azure equivalent of Amazon Detective
Amazon Detective maps most closely to Microsoft Sentinel's incident investigation, entity pages, and UEBA, now in the Microsoft Defender portal.
About Amazon Detective
| Provider | Amazon Web Services |
|---|---|
| Status | Generally available |
| What it is | Automatically collects log data into a behavior graph and links activity to GuardDuty findings, so you can investigate and group related security findings. |
| Documentation | docs.aws.amazon.com |
| Pricing | Official pricing page |
Azure mappings (1)
| Capability | Azure equivalent | Match |
|---|---|---|
| Security investigation and incident analysis | Microsoft Sentinel | Partial match |
Threat detection, posture & security operations(1)
Security investigation and incident analysis Partial match
Amazon Detective maps most closely to Microsoft Sentinel's incident investigation, entity pages, and UEBA, now in the Microsoft Defender portal. Sentinel is a full SIEM and SOAR, while Detective is an investigation tool, and AWS has no first-party SIEM.
- Scope. Detective builds a behavior graph from AWS logs and GuardDuty findings automatically, with no queries to write. Sentinel ingests data from many sources, uses KQL analytics rules, and adds playbooks for automated response.
- Portal. Sentinel is moving to the Microsoft Defender portal and won't be supported in the Azure portal after March 31, 2027.