StartInvestigation

Source: src/AWS/Detective/StartInvestigation.ts

Runtime binding for detective:StartInvestigation.

Kicks off a Detective investigation into an IAM user or role over a time window — the programmatic version of the console’s “Run investigation” button. A security-automation function can trigger triage the moment a GuardDuty finding lands. The graph ARN is injected from the bound Graph. Provide the implementation with Effect.provide(AWS.Detective.StartInvestigationHttp).

Running Investigations

// init — bind the operation to the behavior graph
const startInvestigation = yield* AWS.Detective.StartInvestigation(graph);

// runtime
const { InvestigationId } = yield* startInvestigation({
  EntityArn: suspiciousRoleArn,
  ScopeStartTime: new Date(Date.now() - 24 * 60 * 60 * 1000),
  ScopeEndTime: new Date(),
});