detecting-aws-cloudtrail-anomalies
mukul975/Anthropic-Cybersecurity-Skills
Use boto3 to query AWS CloudTrail logs, build statistical baselines of normal API behavior, and surface unusual event sources, geographic shifts, or anomalous first-time and high-error calls so SOC analysts can investigate credential compromise, privilege escalation, or unauthorized access.