Cloud Forensics (AWS GuardDuty / CloudTrail / S3)

What problem does it solve?

It reduces the time and guesswork needed to triage AWS cloud incidents by transforming GuardDuty and CloudTrail evidence into prioritized findings, timelines, and exfiltration/persistence indicators.

Core Features & Use Cases

• GuardDuty finding triage: Decompress GuardDuty .jsonl.gz and generate high-severity exports, principal pivots, and network IOC-focused extracts.
• CloudTrail timeline reconstruction: Decompress CloudTrail .json.gz, flatten Records into JSONL, and produce event frequency summaries, error/denied-event lists, and CSV timelines for investigation.
• Threat pattern detection: Identify AWS IMDS credential theft signals, IAM persistence (new keys/policy changes), and S3 exfiltration patterns (GetObject/Deletes) from log artifacts.

Use case: You receive a customer’s S3-copied GuardDuty and CloudTrail archives and need to quickly determine whether an attacker attempted credential theft, established IAM persistence, and accessed or deleted S3 objects—without touching originals.

Quick Start

Use the cloud-forensics skill to parse GuardDuty and CloudTrail logs from your case root and produce CSV exports under exports/cloud and analysis/cloud for prioritized triage.