mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-19 22:19:39 +03:00
MAGIandJulio César Suástegui
a072845a3f
- Fix FilterCriteria to use singular Severity/Status with Value objects instead of invalid plural Severities/Statuses arrays (SKILL.md + process.py) - Fix get_entity_history: rename to get_investigation_indicators, use investigation_id instead of entity_arn for InvestigationId parameter - Replace invalid inv-* placeholders with 21-digit numeric IDs - Fix Expected Output to match real API response structure (no embedded Indicators; document separate list-indicators call and indicator types) - Fix CLI --filter-criteria example to use correct format - Update process.py --severity to accept single value with validation - Add --max-results validation (1-100 range) - Add pagination via _collect_all_pages helper for all list API calls - Reorder Response Actions checklist: evidence preservation before containment - Reorder Phase 5 workflow: preserve evidence first when safe
1.1 KiB
1.1 KiB
AWS Detective Investigation Workflow
Phase 1: Triage
- Review GuardDuty HIGH/CRITICAL findings
- Open Detective console → Finding Groups
- Identify clustered findings pointing to same entity
Phase 2: Entity Investigation
- Select entity (IAM user/role, EC2, IP)
- Review 24h behavior timeline
- Identify unusual API calls, new geolocations, impossible travel
- Check for privilege escalation patterns (CreateAccessKey, AttachPolicy)
Phase 3: Scope Assessment
- Trace lateral movement via AssumeRole chains
- Check S3 data access patterns
- Review VPC Flow Logs for unusual outbound connections
- Identify all compromised credentials
Phase 4: Correlation
- Map findings to MITRE ATT&CK techniques
- Build attack timeline from entity profiles
- Identify initial access vector
- Document indicators of compromise (IOCs)
Phase 5: Response
- Preserve evidence (CloudTrail logs, flow logs, snapshots) when safe
- Disable compromised credentials
- Revoke active sessions
- Isolate affected resources
- If active impact is ongoing, contain first and document evidence trade-offs