shadow-ai-aws-vpc-flow

Detect and triage shadow AI usage from AWS VPC Flow Logs, including model-provider egress, Bedrock-adjacent runtime evidence, RAG/vector traffic, model downloads, internal inference services, model brokers, LLM observability, and agent-like timing or fanout patterns. Use when Codex needs to analyze CloudWatch VPC Flow Logs or normalized flow CSV exports for AI usage from network metadata.

Ir a la instalación

Repositorio: transilienceai/transilience-mdr-rainer
Última actividad en el origen: 9 de agosto de 2026 a las 21:15
Idioma detectado de SKILL.md: inglés
Estrellas: 2
Forks: 0

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.

npx skills add https://github.com/transilienceai/transilience-mdr-rainer --skill shadow-ai-aws-vpc-flow

El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.

¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

Explorador de archivos

7 archivos

SKILL.md

Instrucciones de origen · Vista previa de solo lectura

Volver a la búsqueda Volver a la instalación

aws-remediation-leverage

Rank AWS remediations by how many attack chains each one severs, so a team gets maximum blast-radius reduction per fix. Use when you have an aws_attack_chains/v1 file from the chain enumerator and need to turn it into a prioritized "biggest bang for the buck" remediation plan - which single control fix breaks the most kill chains and techniques, a severity-weighted leverage ranking, the crown jewels and accounts each fix protects, and a greedy do-in-this-order roadmap (marginal set-cover) showing how few fixes cover most of the attack surface, and a compounding matrix (which misconfiguration enables the next) so fixing the source control cuts a chain early. Final decision-support stage of the AWS red-team attack-chain suite.

2026-08-09

aws-attack-chain-enumerator

Traverse a merged aws_attack_model/v1 attack graph and emit aws_attack_chains/v1 - ranked kill chains from an entry (internet or a single stolen credential) to crown jewels, the atomic technique catalog of attack primitives actually present, and root causes rolled up by control. Use when turning a merged AWS attack model into scored attacker kill chains, an ATT&CK-mapped technique catalog, prioritized root causes, or the input a red-team report packager renders.

2026-08-09

aws-attack-graph-builder

Merge one or more aws_attack_model/v1 envelopes from the AWS attack-surface / identity-trust / crown-jewel / active-threat collectors into a single, de-duplicated attack graph ready for chain enumeration. Use when combining multiple collector outputs into one model, reconciling nodes and edges across accounts, validating that every edge references a real node, or producing the merged attack_model.json that aws-attack-chain-enumerator traverses.

2026-08-09

Ver todos los de este repositorio

name	shadow-ai-aws-vpc-flow
description	Detect and triage shadow AI usage from AWS VPC Flow Logs, including model-provider egress, Bedrock-adjacent runtime evidence, RAG/vector traffic, model downloads, internal inference services, model brokers, LLM observability, and agent-like timing or fanout patterns. Use when Codex needs to analyze CloudWatch VPC Flow Logs or normalized flow CSV exports for AI usage from network metadata.

AWS VPC Flow Shadow AI Detection

Use this skill to turn VPC Flow Logs into AI-usage evidence.

Workflow

Confirm the log source, AWS account/region, time window, and whether the input is CloudWatch Logs or an offline CSV export.
Run scripts/analyze_vpc_flow_shadow_ai.py with either --log-group or --input-csv.
Review confidence levels before making claims:
- high: Bedrock CloudTrail model invocation or trusted historical DNS/proxy/service-inventory join.
- medium: current DNS, PTR, or endpoint catalog match to known AI infrastructure.
- low: internal port or private-IP heuristic without workload inventory.
- context: supporting cadence, bytes, packet, registry, or fanout evidence.
Review NAT and workload-attribution limitations before naming a source workload.
Hand the output directory to aws-vpc-flow-security-report for reporting.

Evidence Interpretation

Treat public SaaS endpoint matches as provider-path evidence, not proof of exact model name.
Treat internal Qdrant, Redis, Postgres, OpenSearch, Ollama, vLLM, and Triton-style ports as low-confidence until inventory confirms purpose.
Treat NAT gateway rows as egress evidence unless packet source fields or inventory preserve the original workload.
Use CloudTrail or gateway logs for Bedrock model IDs and exact API actions.
Use Route 53 Resolver, proxy, SNI, gateway, or OpenTelemetry logs to raise confidence beyond current DNS/PTR matching.

Outputs

The analyzer writes:

flow-summary.csv
ai-candidate-flows.csv
workload-ai-summary.csv
hourly-top-destinations.csv
ai-domain-resolution.csv
bedrock-cloudtrail-events.json
raw-query-manifest.json

Keep customer raw logs and generated reports out of public repositories.

shadow-ai-aws-vpc-flow

Datos de origen

Opciones de instalación

Revisa los archivos de origen

Más de este repositorio

Más de este repositorio

AWS VPC Flow Shadow AI Detection

Workflow

Evidence Interpretation

Outputs

AWS VPC Flow Shadow AI Detection

Workflow

Evidence Interpretation

Outputs