Monitoring usage and cost for a behavior graph (administrator account)

Amazon Detective bills each account for the data used in each behavior graph that the account belongs to. Detective charges a tiered flat rate per GB for all data regardless of the source.

For administrator accounts, the Usage page of the Detective console allows you to view the volume of data ingested By data source or By account over the previous 30 days. Administrator accounts also see a projected cost for a typical 30-day period for their account and for the entire behavior graph.

To view Detective usage information

1. Sign in to the AWS Management Console. Then open the Detective console at https://console.aws.amazon.com/detective/.

2. In the Detective navigation pane, under Settings, choose Usage.

3. Choose a tab to select between viewing usage By data source or By account.

Volume of data ingested for each account

Ingested volume by member account lists the active accounts in the behavior graph. It does not list member accounts that were removed.

For each account, the ingested volume list provides the following information.

• The AWS account identifier and root user email address.

• The date when the account began to contribute data to the behavior graph.

  For the administrator account, this is the date when the account enabled Detective.

  For member accounts, this is the date when an account was enabled as a member account after accepting the invitation.

• The volume of ingested data from the account over the previous 30 days. The total includes all source types.

• Whether the account is currently in the free trial period. For accounts that are currently in their free trial period, the list displays the number of days remaining.

  If none of the accounts are in the free trial period, then the free trial status column is not displayed.

Projected costs for the behavior graph

This account's projected cost shows a projected cost for 30 days of data for the administrator account. The projected cost is based on the daily average volume for the administrator account.

Important

This amount is a projected cost only. It projects the total cost for the administrator account data for a typical 30-day time period. It is based on the usage from the previous 30 days. See How Amazon Detective calculates projected cost.

Projected cost for the behavior graph

All accounts' projected cost shows a total projected cost for 30 days of data for the entire behavior graph. The projected cost is based on the daily average volume for each account.

Important

This amount is a projected cost only. It projects the total cost for the behavior graph data for a typical 30-day time period. It is based on the usage from the previous 30 days. The projected cost does not include member accounts that were removed from the behavior graph. See How Amazon Detective calculates projected cost.

Volume of data ingested by source packages

Select By source package to view the volume of data ingested listed by the different source packages enabled in your behavior graph.

All accounts can view this data for their own accounts. An administrator account can see additional panels that list the usage by source package for each member. It does not list member accounts that were removed.

Detective core

Detective core panels show the volume of data ingested from Detective core sources (CloudTrail logs, VPC Flow logs, and GuardDuty findings) for the last 30 days.

EKS audit logs

EKS audit logs panels show the volume of data ingested from EKS audit logs sources for the last 30 days. Panels for this source package are only available if EKS audit logs is enabled for your behavior graph.