Introducing the Amazon GuardDuty investigation agent: on-demand AI-powered threat assessment

It looks like you're working with AWS GuardDuty investigations and want to understand how to initiate, monitor, and retrieve results from these investigations using the AWS Command Line Interface (CLI). Below is a summary of the steps involved:

Step 1: Find Your Detector ID

To start an investigation, you need to know your detector ID. This unique identifier can be found in the GuardDuty console under Settings or by running the following command for the specific Region where GuardDuty is enabled:

bash
 
1aws guardduty list-detectors --region=us-east-1

The response will provide you with a DetectorIds array, from which you can extract your detector ID.

Step 2: Create an Investigation

Once you have the detector ID, you can initiate an investigation using the create-investigation command. Here are examples of how to create investigations for specific findings, entire accounts, or across an organization:

For a Specific Finding:

bash
 
1aws guardduty create-investigation --region=us-east-1 \
2    --detector-id 12abc34d567e8fa901bc2d34eexample \
3    --
4
5[Read the full article at AWS Security Blog](https://aws.amazon.com/blogs/security/introducing-the-amazon-guardduty-investigation-agent-on-demand-ai-powered-threat-assessment/)
6
7---
8
9**Want to create content about this topic?** [Use Nemati AI tools](https://nemati.ai) to generate articles, social posts, and more.