detecting-aws-cloudtrail-anomalies
mukul975/Anthropic-Cybersecurity-Skills
Detect suspicious API usage in AWS CloudTrail by querying events with boto3, building statistical baselines, and flagging anomalies such as new event sources, geographic shifts, frequent failures, and sensitive IAM/KMS/S3 calls to surface potential credential compromise or insider threat activity.