mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-25 13:50:59 +03:00
MAGIandJulio César Suástegui
a072845a3f
- Fix FilterCriteria to use singular Severity/Status with Value objects instead of invalid plural Severities/Statuses arrays (SKILL.md + process.py) - Fix get_entity_history: rename to get_investigation_indicators, use investigation_id instead of entity_arn for InvestigationId parameter - Replace invalid inv-* placeholders with 21-digit numeric IDs - Fix Expected Output to match real API response structure (no embedded Indicators; document separate list-indicators call and indicator types) - Fix CLI --filter-criteria example to use correct format - Update process.py --severity to accept single value with validation - Add --max-results validation (1-100 range) - Add pagination via _collect_all_pages helper for all list API calls - Reorder Response Actions checklist: evidence preservation before containment - Reorder Phase 5 workflow: preserve evidence first when safe
32 lines
1.1 KiB
Markdown
32 lines
1.1 KiB
Markdown
# AWS Detective Investigation Workflow
|
|
|
|
## Phase 1: Triage
|
|
1. Review GuardDuty HIGH/CRITICAL findings
|
|
2. Open Detective console → Finding Groups
|
|
3. Identify clustered findings pointing to same entity
|
|
|
|
## Phase 2: Entity Investigation
|
|
1. Select entity (IAM user/role, EC2, IP)
|
|
2. Review 24h behavior timeline
|
|
3. Identify unusual API calls, new geolocations, impossible travel
|
|
4. Check for privilege escalation patterns (CreateAccessKey, AttachPolicy)
|
|
|
|
## Phase 3: Scope Assessment
|
|
1. Trace lateral movement via AssumeRole chains
|
|
2. Check S3 data access patterns
|
|
3. Review VPC Flow Logs for unusual outbound connections
|
|
4. Identify all compromised credentials
|
|
|
|
## Phase 4: Correlation
|
|
1. Map findings to MITRE ATT&CK techniques
|
|
2. Build attack timeline from entity profiles
|
|
3. Identify initial access vector
|
|
4. Document indicators of compromise (IOCs)
|
|
|
|
## Phase 5: Response
|
|
1. Preserve evidence (CloudTrail logs, flow logs, snapshots) when safe
|
|
2. Disable compromised credentials
|
|
3. Revoke active sessions
|
|
4. Isolate affected resources
|
|
5. If active impact is ongoing, contain first and document evidence trade-offs
|