aws-guardduty-explainer

What This Skill Does

The aws-guardduty-explainer skill acts as an intelligent security operations assistant within the OpenClaw ecosystem. It transforms complex, verbose AWS GuardDuty JSON payloads into clear, actionable incident reports. Instead of manually parsing raw log files or navigating the AWS console to interpret findings, you can simply feed the JSON to this skill. It analyzes the threat vector, assesses the potential impact on your infrastructure, correlates the finding with MITRE ATT&CK techniques, and provides a structured, multi-step response playbook. This skill focuses on translating machine-generated alerts into human-readable narratives, helping security teams reduce mean time to resolution (MTTR) for high-priority threats.

Installation

To integrate this capability into your workflow, run the following command in your terminal: clawhub install openclaw/skills/skills/anmolnagpal/guardduty-explainer

Use Cases

• Incident Response Acceleration: Instantly generate remediation steps for alerts like SSH brute force or malicious IP interactions without searching through documentation.
• Security Posture Reporting: Quickly summarize high-severity findings for stakeholders who do not have access to the AWS console.
• Automated Triage: Use the tool to differentiate between routine system behavior and genuine malicious activity by evaluating the false positive likelihood assigned to each finding.

Example Prompts

1. "Analyze this GuardDuty finding: [Paste JSON here]. I need a containment plan for this EC2 instance immediately."
2. "I have 5 active findings with severity 5. Run an analysis and prioritize which one I should address first based on the MITRE ATT&CK mapping."
3. "The GuardDuty report shows 'UnauthorizedAccess:EC2/SSHBruteForce'. What are the specific AWS CLI commands to quarantine this instance and rotate the instance profile keys?"

Tips & Limitations

This skill is strictly an analytical engine and does not have the permissions to execute changes directly in your AWS environment. Users are responsible for executing the suggested CLI commands provided in the output. For the most accurate results, always provide the full JSON payload rather than just the summary text. The accuracy of the risk assessment is dependent on the data quality of the original AWS GuardDuty findings.