This rule detects the deletion of an Amazon Detective behavior graph by monitoring AWS CloudTrail for a DeleteGraph call from detective.amazonaws.com with a successful outcome. Amazon Detective builds a behavior graph from CloudTrail, VPC Flow Logs, and GuardDuty findings to enable investigators to trace relationships and timelines during an incident. Deleting the graph permanently removes historical analysis data and the ability to investigate incidents using Detective’s graph, reducing forensic visibility. An attacker with sufficient IAM permissions could delete the graph to hinder incident response and impede investigation. The rule triggers when the data stream dataset is aws.cloudtrail, the event provider is detective.amazonaws.com, the action is DeleteGraph, and the outcome is success, within logs ingested to logs-aws.cloudtrail-*. The rule has a MITRE ATT&CK mapping to Defense Evasion (TA0005) with subtechnique T1562.001 Disable or Modify Tools and a risk_score of 21 (severity: low). Investigation fields include: @timestamp, aws.cloudtrail.user_identity.arn, aws.cloudtrail.user_identity.type, aws.cloudtrail.user_identity.access_key_id, user.name, event.action, event.outcome, source.ip, cloud.region, cloud.account.id. Investigation steps include verifying caller identity, checking for preceding defense-evasion actions, assessing the period of activity and data loss, and reviewing IAM actions by the identity in the prior 24 hours. False positives may occur during legitimate decommissioning or removal of Detective deployments; verify against change management records. Remediation guidance includes re-enabling Amazon Detective, reconstructing context from raw logs, revoking active sessions if unauthorized, and adding a strict SCP to restrict detective:DeleteGraph for break-glass admin roles. References: AWS DeleteGraph API documentation. Setup notes: Ensure the AWS integration ingests management events into logs-aws.cloudtrail-* and Detective is enabled for the event to be detected.