skills.rest
YukiIto1999
YukiIto1999COMMUNITY
Explore all skills by this author →
GitHub

performing-cloud-native-threat-hunting-with-aws-detective

Automate AWS Detective threat hunting across behavior graphs, investigations, and indicators.

Updated Apr 23, 2026
Search Tags:#detective#aws#iam#cloud-security#threat-hunting#guardduty#behavior-graph
One-click install
npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill performing-cloud-native-threat-hunting-with-aws-detective
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-cloud-native-threat-hunting-with-aws-detective
Source: https://github.com/YukiIto1999/ctf-sleuth/tree/main/.claude/skills/performing-cloud-native-threat-hunting-with-aws-detective
Command: npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill performing-cloud-native-threat-hunting-with-aws-detective

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires boto3, and includes scripts (resource) and references (resource) components.

What problem does it solve?

AWS Detective-based threat hunting automates the discovery and investigation of cloud-native threats by building behavior graphs, entity timelines, and correlation of GuardDuty findings across IAM users, EC2 instances, and IP addresses to accelerate incident response.

Core Features & Use Cases

  • Behavior-graph driven threat hunting across CloudTrail, VPC Flow Logs, and GuardDuty findings to map actor timelines
  • Entity profiling and investigation timelines for IAM users, roles, EC2 instances, and IPs
  • Correlation of GuardDuty findings into cohesive attack narratives to prioritize response

Quick Start

List all Detective behavior graphs and show investigations for suspicious entities in the target AWS account.

Frequently Asked Questions about performing-cloud-native-threat-hunting-with-aws-detective

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How does AWS Detective threat hunting map attacker behavior across cloud-native resources?▼

AWS Detective threat hunting maps attacker behavior by building behavior graphs from CloudTrail, VPC Flow Logs, and GuardDuty findings to visualize IAM users, EC2 instances, and IP address timelines.

What do I need to start investigating GuardDuty findings with behavior graphs in AWS?▼

To investigate GuardDuty findings with behavior graphs, you need AWS Detective enabled, GuardDuty data, CloudTrail and VPC Flow Logs access, and a Python environment with boto3 to run the threat hunting workflow.

Can I profile IAM users and EC2 instances to correlate GuardDuty findings into attack narratives?▼

Yes, you can profile IAM users, roles, and EC2 instances by extracting investigation timelines and correlating GuardDuty findings to build cohesive attack narratives for prioritized incident response.

What is the best way to automate cloud-native threat hunting across multiple AWS accounts using Detective?▼

Automating cloud-native threat hunting across AWS accounts requires a Python-based workflow using boto3 to enumerate Detective behavior graphs, investigations, and indicators for suspicious entities.

Why use AWS Detective for threat hunting instead of manually analyzing CloudTrail and VPC Flow Logs?▼

Using AWS Detective accelerates incident response over manual log analysis by automatically building behavior graphs and entity timelines that correlate GuardDuty findings across IAM and EC2 resources.

Does this threat hunting workflow require GuardDuty to be enabled alongside Detective?▼

Yes, the threat hunting workflow requires GuardDuty data enabled alongside AWS Detective, as it correlates GuardDuty findings into cohesive attack narratives using behavior graphs and entity timelines.

Related Skills

Explore More Data & Analytics Skills→
YukiIto1999YukiIto1999

performing-cloud-log-forensics-with-athena

Query AWS CloudTrail, VPC Flow, S3, and ALB logs with Athena.

Community
Advanced
zenobi-uszenobi-us
68

incident-responder

Coordinate incident response for security breaches and operational incidents.

Official
Advanced
balsm-healthbalsm-health
2

detecting-s3-data-exfiltration-attempts

Detect AWS S3 data exfiltration attempts by analyzing CloudTrail logs.

Official
Advanced
ArdurAIArdurAI
1

god-security-cloud

Audit AWS, Azure, and GCP configurations for security misconfigurations.

Official
Advanced