performing-cloud-forensics-with-aws-cloudtrail

What problem does it solve?

Perform forensic investigation of AWS environments using CloudTrail logs to reconstruct attacker activity, identify compromised credentials, and analyze API call patterns.

Core Features & Use Cases

• Reconstruct attacker timeline from CloudTrail events using LookupEvents and optional Athena queries.
• Track compromised credentials via AccessKeyId, UserName, EventName patterns, and source IPs for attribution.
• Generate forensic reports including persistence detection and inventory of suspicious API calls for incident response.

Quick Start

Run the forensics agent to scan CloudTrail logs and generate a forensic report.