Anthropic-Cybersecurity-Skills/skills/performing-cloud-native-threat-hunting-with-aws-detective/references/workflows.md

# AWS Detective Investigation Workflow

## Phase 1: Triage
1. Review GuardDuty HIGH/CRITICAL findings
2. Open Detective console → Finding Groups
3. Identify clustered findings pointing to same entity

## Phase 2: Entity Investigation
1. Select entity (IAM user/role, EC2, IP)
2. Review 24h behavior timeline
3. Identify unusual API calls, new geolocations, impossible travel
4. Check for privilege escalation patterns (CreateAccessKey, AttachPolicy)

## Phase 3: Scope Assessment
1. Trace lateral movement via AssumeRole chains
2. Check S3 data access patterns
3. Review VPC Flow Logs for unusual outbound connections
4. Identify all compromised credentials

## Phase 4: Correlation
1. Map findings to MITRE ATT&CK techniques
2. Build attack timeline from entity profiles
3. Identify initial access vector
4. Document indicators of compromise (IOCs)

## Phase 5: Response
1. Disable compromised credentials
2. Revoke active sessions
3. Isolate affected resources
4. Preserve evidence (CloudTrail logs, flow logs)