aws-cloudtrail-threat-detector

What This Skill Does

The AWS CloudTrail Threat Detector is a specialized forensic analysis agent designed to ingest AWS CloudTrail logs and transform raw JSON event data into a coherent security narrative. As an OpenClaw AI skill, it acts as a virtual incident responder. It parses complex, high-volume event logs to identify unauthorized API calls, privilege escalation attempts, persistence mechanisms, and reconnaissance activities. By mapping event sequences to the MITRE ATT&CK Cloud Matrix, it helps security teams quickly transition from raw log exploration to concrete containment and remediation steps.

Installation

To integrate this skill into your environment, run the following command within your OpenClaw interface: clawhub install openclaw/skills/skills/anmolnagpal/cloudtrail-threat-detector Ensure your local environment or workspace has proper read permissions if you intend to stream log data directly into the agent.

Use Cases

• Post-Incident Forensic Reconstruction: Reconstruct an attacker's steps after an alert is triggered, linking disparate events into a single kill chain.
• Unauthorized Privilege Escalation Detection: Automatically flag AttachUserPolicy or CreateLoginProfile calls that deviate from standard CI/CD deployment patterns.
• Threat Hunting: Proactively audit logs for 'Low and Slow' reconnaissance patterns, such as repeated DescribeInstances calls originating from unfamiliar external IPs.
• Compliance Reporting: Generate a clean, plain-English summary of suspicious activity for stakeholders who do not have deep familiarity with AWS CloudTrail JSON structures.

Example Prompts

1. "I've noticed unusual activity in our production account between 2 AM and 4 AM. Please analyze this JSON file [attach file] and let me know if there's any evidence of credential theft."
2. "Look at these CloudWatch log events. Someone managed to create a new IAM user and attach AdministratorAccess. Tell me exactly what happened, when it happened, and how I can contain this."
3. "I suspect an attacker has modified our bucket policies to make them public. Analyze these logs and provide a summary of the source IP, the identity involved, and a list of impacted S3 buckets."

Tips & Limitations

• Context is King: The more logs you provide, the higher the accuracy of the timeline. Always try to include a 15-minute buffer before and after the suspected breach window.
• Data Privacy: This skill performs client-side analysis. It does not possess direct AWS credentials or live access to your environment; it processes only the text you provide.
• False Positives: Automated tools might flag legitimate administrative automation. Always verify the 'principal' field against your list of known service accounts and CI/CD pipelines.