A forensic analysis service that builds a behavior graph from GuardDuty, CloudTrail, and VPC Flow Logs data, making it easier to investigate the root cause of a security finding and visualize relationships between resources, IPs, and users.
In SAP-C02 it's used after GuardDuty generates a finding: Detective helps answer "how did this incident start and what other resources are involved?" It doesn't detect threats itself — it analyzes ones already detected.
Amazon Detective is a concept that can show up on the exam. Check the full guide to see it in context.