mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-09-02 22:50:49 +03:00
MAGI
a072845a3f
- Fix FilterCriteria to use singular Severity/Status with Value objects instead of invalid plural Severities/Statuses arrays (SKILL.md + process.py) - Fix get_entity_history: rename to get_investigation_indicators, use investigation_id instead of entity_arn for InvestigationId parameter - Replace invalid inv-* placeholders with 21-digit numeric IDs - Fix Expected Output to match real API response structure (no embedded Indicators; document separate list-indicators call and indicator types) - Fix CLI --filter-criteria example to use correct format - Update process.py --severity to accept single value with validation - Add --max-results validation (1-100 range) - Add pagination via _collect_all_pages helper for all list API calls - Reorder Response Actions checklist: evidence preservation before containment - Reorder Phase 5 workflow: preserve evidence first when safe
35 lines
1.1 KiB
Markdown
35 lines
1.1 KiB
Markdown
# AWS Detective Investigation Checklist
|
|
|
|
## Pre-Investigation
|
|
- [ ] Confirm Detective is enabled and receiving data
|
|
- [ ] Identify trigger (GuardDuty finding, alert, manual hunt)
|
|
- [ ] Define scope time window
|
|
- [ ] Document initial IOCs
|
|
|
|
## Entity Investigation
|
|
- [ ] IAM User/Role profile reviewed
|
|
- [ ] API call timeline analyzed
|
|
- [ ] Geographic anomalies checked (impossible travel)
|
|
- [ ] New API calls identified (never seen before)
|
|
- [ ] Privilege escalation attempts documented
|
|
- [ ] AssumeRole chain traced
|
|
|
|
## Network Analysis
|
|
- [ ] VPC Flow Logs reviewed for entity
|
|
- [ ] Outbound connections to suspicious IPs identified
|
|
- [ ] Data transfer volumes assessed
|
|
- [ ] DNS query patterns checked
|
|
|
|
## Finding Correlation
|
|
- [ ] All related GuardDuty findings grouped
|
|
- [ ] MITRE ATT&CK techniques mapped
|
|
- [ ] Attack timeline constructed
|
|
- [ ] Initial access vector identified
|
|
|
|
## Response Actions
|
|
- [ ] Evidence preserved (or capture rationale if immediate containment required)
|
|
- [ ] Compromised credentials disabled
|
|
- [ ] Active sessions revoked
|
|
- [ ] Affected resources isolated
|
|
- [ ] Stakeholders notified
|