transilience-mdr-rainer

Build business-as-usual baselines from normalized AWS CloudTrail observations. Use when analyzing AWS control-plane activity to understand normal business operations, actor/event/source-IP tuples, account behavior, application communication patterns, CI/CD deployment patterns, user access, identity changes, storage/KMS, network changes, database operations, or alertable deviations from prior CloudTrail activity.

Convert AWS CloudTrail event clusters, baselines, detection candidates, or evidence packs into business-context triage findings. Use when explaining what happened, why it likely happened, whether it looks like business-as-usual, what residual risk remains, what to verify, and what controls to remediate for CloudTrail investigations.

Generate portable AWS CloudTrail detection specifications from a CloudTrail business baseline, normalized observations, or evidence pack. Use for alert logic covering root activity, access-key creation, IAM role/policy writes, unmanaged egress, password-policy changes, S3 bucket deletion, audit-log tamper, network exposure changes, destructive database actions, KMS grant/key changes, and baseline drift without binding to a specific SIEM.

Collect reproducible AWS CloudTrail management events through CloudTrail LookupEvents. Use when making live AWS CloudTrail calls across accounts, roles, regions, event names, and time windows, especially when the output must include exact boto3 parameters, AWS CLI equivalents, call ledgers, capped-query markers, raw CloudTrailEvent payloads, and normalized observation JSONL for later baseline or alert analysis.

Normalize AWS CloudTrail records into a stable business-analysis observation schema. Use when working with CloudTrail LookupEvents output, raw CloudTrail JSON, CloudTrail JSONL, QRadar decoded_payload records, evidence-pack wrappers, actor/source-IP/event baselining, or when another AWS CloudTrail skill needs normalized observations before baseline, detection, triage, or reporting.

Package actual raw AWS CloudTrail events into reproducible evidence bundles. Use when extracting CloudTrail records from LookupEvents output, CloudTrail JSON/JSONL, QRadar or SIEM decoded_payload fields, or investigation case filters, and when the report must include exact calls, file extraction commands, event-to-call indexes, records-only JSON, manifests, and reproduction metadata.

Package AWS CloudTrail baselines, evidence packs, detection specs, and business triage into customer-facing reports. Use when producing Markdown or PDF-ready reports that need executive summaries, finding cards, remediation roadmaps, evidence appendices, reproduction commands, or Transilience-style CloudTrail investigation and business-baseline documents.