mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-08-02 09:07:41 +03:00
MAGIandJulio César Suástegui
a072845a3f
- Fix FilterCriteria to use singular Severity/Status with Value objects instead of invalid plural Severities/Statuses arrays (SKILL.md + process.py) - Fix get_entity_history: rename to get_investigation_indicators, use investigation_id instead of entity_arn for InvestigationId parameter - Replace invalid inv-* placeholders with 21-digit numeric IDs - Fix Expected Output to match real API response structure (no embedded Indicators; document separate list-indicators call and indicator types) - Fix CLI --filter-criteria example to use correct format - Update process.py --severity to accept single value with validation - Add --max-results validation (1-100 range) - Add pagination via _collect_all_pages helper for all list API calls - Reorder Response Actions checklist: evidence preservation before containment - Reorder Phase 5 workflow: preserve evidence first when safe
1.1 KiB
1.1 KiB
AWS Detective Investigation Checklist
Pre-Investigation
- Confirm Detective is enabled and receiving data
- Identify trigger (GuardDuty finding, alert, manual hunt)
- Define scope time window
- Document initial IOCs
Entity Investigation
- IAM User/Role profile reviewed
- API call timeline analyzed
- Geographic anomalies checked (impossible travel)
- New API calls identified (never seen before)
- Privilege escalation attempts documented
- AssumeRole chain traced
Network Analysis
- VPC Flow Logs reviewed for entity
- Outbound connections to suspicious IPs identified
- Data transfer volumes assessed
- DNS query patterns checked
Finding Correlation
- All related GuardDuty findings grouped
- MITRE ATT&CK techniques mapped
- Attack timeline constructed
- Initial access vector identified
Response Actions
- Evidence preserved (or capture rationale if immediate containment required)
- Compromised credentials disabled
- Active sessions revoked
- Affected resources isolated
- Stakeholders notified