detecting-aws-cloudtrail-anomalies
From the author
Detect unusual API call patterns in AWS CloudTrail logs using boto3, statistical baselining, and behavioral analysis to identify credential compromise, privilege escalation, and unauthorized resource access.
Install
npx skills add 26zl/cybersec-toolkit --skill detecting-aws-cloudtrail-anomalies -a claude-code
Installs to .claude/skills/detecting-aws-cloudtrail-anomalies/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
- Ships scripts we have not reviewedLow
Why 77
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- aws-cloudtrailBagelHole/DevOps-Security-Agent-SkillsConfigure AWS CloudTrail for audit logging. Set up organization trails and event analysis. Use when auditing AWS activity.DevOps★ 1.2K
- cloudtrail-cost-optimizationaws/tools-for-devops-agentIdentify and quantify AWS CloudTrail cost optimization opportunities. Use this skill when a user asks to reduce, review, audit, or optimize CloudTrail spend, or reports an unexpected CloudTrail cost or usage increase. Activate on requests like "why is my CloudTrail bill so high", "reduce CloudTrail costs", "find duplicate CloudTrail trails", "CloudTrail cost review", "optimize CloudTrail Lake", or "CloudTrail data events are expensive". This skill analyzes trails, event selectors, and CloudTrail Lake event data stores through read-only AWS APIs to surface duplicate management-event trails, unnecessary read events, high-volume noise events (KMS, RDS Data API), overly broad data event logging, and Lake ingestion/retention waste, producing a severity-ranked report of savings.DevOps★ 116
- detecting-azure-lateral-movement26zl/cybersec-toolkitDetect lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL hunting queries, and sign-in anomaly correlation to identify privilege escalation, token theft, and cross-tenant pivoting.DevOps★ 82
- auditing-aws-s3-bucket-permissions26zl/cybersec-toolkitSystematically audit AWS S3 bucket permissions to identify publicly accessible buckets, overly permissive ACLs, misconfigured bucket policies, and missing encryption settings using AWS CLI, S3audit, and Prowler to enforce least-privilege data access controls.DevOps★ 82
- aws-cost-operationszxkane/aws-skillsAWS cost optimization, monitoring, and operational excellence expert. Use when analyzing AWS bills, estimating costs, setting up CloudWatch alarms, querying logs, auditing CloudTrail activity, or assessing security posture. Essential when user mentions AWS costs, spending, billing, budget, pricing, CloudWatch, observability, monitoring, alerting, CloudTrail, audit, or wants to optimize AWS infrastructure costs and operational efficiency.DevOps★ 371
- aws-cloudformation-cloudwatchgiuseppe-trisciuoglio/developer-kitProvides AWS CloudFormation patterns for CloudWatch monitoring, metrics, alarms, dashboards, logs, and observability. Use when creating CloudWatch metrics, alarms, dashboards, log groups, log subscriptions, anomaly detection, synthesized canaries, Application Signals, and implementing template structure with Parameters, Outputs, Mappings, Conditions, cross-stack references, and CloudWatch best practices for monitoring production infrastructure.DevOps★ 363
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in