Skill UI

This skill analyzes AWS CloudTrail logs to detect suspicious API call patterns, such as new event sources, geographic anomalies, or high-frequency usage. It establishes a statistical baseline of normal activity and flags deviations indicative of compromised credentials, privilege escalation, or insider threats, providing a detailed JSON report for security investigation and threat hunting.

This skill provides a comprehensive guide and structured SQL templates for performing deep forensic investigations on AWS cloud logs. It utilizes AWS Athena to query massive datasets from CloudTrail, VPC Flow Logs, S3 access logs, and ALB logs. Ideal for detecting unauthorized access, data exfiltration, and privilege escalation during security incident response.

This skill guides users on performing advanced, cloud-native threat hunting using AWS Detective. It leverages interactive behavior graphs, entity investigation timelines, and GuardDuty correlations to automatically analyze AWS logs (CloudTrail, VPC Flow Logs, etc.). Users can efficiently investigate suspicious IAM users, detect lateral movement, and correlate complex attack narratives across multiple AWS services.