Skill Market

detecting aws cloudtrail anomalies

Detect unusual API call patterns in AWS CloudTrail logs using boto3, statistical baselining, and behavioral analysis

GitHub
githubcommunityai-agentsclaude-codecloud-securitycybersecuritydevsecopsethical-hacking
0.0
0 installs33.4K GitHub starsby mukul975

Skill Introduction

Overview
Detect unusual API call patterns in AWS CloudTrail logs using boto3, statistical baselining, and behavioral analysis

Core value

Turns reusable Debugging know-how into an installable skill, helping users complete github, community, ai-agents, claude-code work faster.

Target users

  • Developers, testers, and maintainers who handle Debugging tasks in Focus Code.
  • Teams that already trust workflows or content from mukul975.
  • Users who want standardized prompts, steps, or conventions instead of repeating setup work.

Best practices

  • Read the skill content first to confirm required inputs, expected outputs, and dependencies.
  • Try it on a small task before relying on it for critical work.
  • Add project-specific constraints such as coding style, target platform, test expectations, and delivery format.
  • For external sources, verify the source link, version, and recent maintenance activity.

Best use cases

  • Tasks related to github, community, ai-agents, claude-code that need a reusable execution flow.
  • Converting a community repo, team convention, or personal workflow into day-to-day assistance.
  • Starting from a proven skill instead of writing prompts or procedures from scratch.

Limits and boundaries

  • Results depend on the quality of the original skill content and may need human correction.
  • It does not replace code review, tests, security review, or professional judgment.
  • External tools, APIs, account permissions, and local dependencies still need separate setup.

Differentiation

  • Structured around Debugging, making it easier to discover and reuse than loose prompt snippets.
  • Marked as GitHub, which helps users judge trust and maintenance expectations.
  • Keeps the original source link available for repository, documentation, or discussion follow-up.
  • Tagged with github, community, ai-agents, claude-code, so it can be filtered by concrete task intent.

Install and use

Install
Copy Install Command
focus install detecting-aws-cloudtrail-anomalies-1232dc
View source

Detail Preview

SKILL.md

Primary filemarkdown3 KB

name: detecting-aws-cloudtrail-anomalies description: Detect unusual API call patterns in AWS CloudTrail logs using boto3, statistical baselining, and behavioral analysis to identify credential compromise, privilege escalation, and unauthorized resource access. domain: cybersecurity subdomain: cloud-security tags:

  • cloud-security
  • aws
  • cloudtrail
  • anomaly-detection
  • threat-detection
  • boto3 version: '1.0' author: mahipal license: Apache-2.0 nist_csf:
  • PR.IR-01
  • ID.AM-08
  • GV.SC-06
  • DE.CM-01

Detecting AWS CloudTrail Anomalies

Overview

AWS CloudTrail records API calls across AWS services. This skill covers querying CloudTrail events with boto3's lookup_events API, building statistical baselines of normal API activity, detecting anomalies such as unusual event sources, geographic anomalies, high-frequency API calls, and first-time API usage patterns that indicate compromised credentials or insider threats.

When to Use

  • When investigating security incidents that require detecting aws cloudtrail anomalies
  • When building detection rules or threat hunting queries for this domain
  • When SOC analysts need structured procedures for this analysis type
  • When validating security monitoring coverage for related attack techniques

Prerequisites

  • Python 3.9+ with boto3 library
  • AWS credentials with CloudTrail read permissions (cloudtrail:LookupEvents)
  • Understanding of AWS IAM and common API patterns
  • CloudTrail enabled in target AWS account (management events at minimum)

Steps

Step 1: Query CloudTrail Events

Use boto3 CloudTrail client's lookup_events to retrieve recent API activity with pagination.

Step 2: Build Activity Baseline

Aggregate events by user, source IP, event source, and event name to establish normal behavior patterns.

Step 3: Detect Anomalies

Flag unusual patterns: new event sources per user, first-time API calls, geographic IP changes, high error rates, and sensitive API usage (IAM, KMS, S3 policy changes).

Step 4: Generate Detection Report

Produce a JSON report with anomaly scores, top suspicious users, and recommended investigation actions.

Expected Output

JSON report with event statistics, baseline deviations, anomalous users/IPs, sensitive API calls, and error rate analysis.

Reviews

Overall rating

0.0
0.0

0 comments

No reviews yet