aws-cloudtrail-business-triage

name	aws-cloudtrail-business-triage
description	Convert AWS CloudTrail event clusters, baselines, detection candidates, or evidence packs into business-context triage findings. Use when explaining what happened, why it likely happened, whether it looks like business-as-usual, what residual risk remains, what to verify, and what controls to remediate for CloudTrail investigations.

AWS CloudTrail Business Triage

Use this skill when the raw events are known but the customer needs the operational interpretation.

Quick Start

python3 ../../skills/aws/cloudtrail/business-triage/scripts/triage_cloudtrail_findings.py \
  --evidence-pack evidence_pack \
  --baseline baseline.json \
  --detection-specs cloudtrail_detection_specs.json \
  --output triage_findings.md

Triage Structure

For each finding, produce:

• what happened
• why it likely happened
• evidence summary
• business-as-usual assessment
• residual risk
• verification steps
• remediation actions
• alerting implication

Rules

• Separate probable legitimate activity from residual control risk.
• Do not call activity benign solely because it repeats.
• Treat root, audit-log deletion, IAM privilege creation, access-key creation, and destructive resource changes as requiring verification even when likely authorized.
• Prefer named business patterns: CI/CD rotation, break-glass root use, contractor Terraform, CloudShell admin sweep, decommission cleanup.
• Tie every high-confidence statement to evidence fields: actor, account, event names, source IPs, user agent, MFA, cadence, resource names.