aws-cloudtrail-lookup-collector

Collect reproducible AWS CloudTrail management events through CloudTrail LookupEvents. Use when making live AWS CloudTrail calls across accounts, roles, regions, event names, and time windows, especially when the output must include exact boto3 parameters, AWS CLI equivalents, call ledgers, capped-query markers, raw CloudTrailEvent payloads, and normalized observation JSONL for later baseline or alert analysis.

跳到安装

仓库: transilienceai/transilience-mdr-rainer
最近来源活动: 2026年8月9日 21:15
检测到的 SKILL.md 语言: 英语
星标: 2
分支: 0

安装方式

默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

直接命令不会经过审查 Prompt；运行前请先检查来源。

npx skills add https://github.com/transilienceai/transilience-mdr-rainer --skill aws-cloudtrail-lookup-collector

命令会保持在同一行。复制前请横向滚动并检查完整内容。

想先保存到本地？可下载 SkillsMP 当前能够提供的文件。

检查来源文件

决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。

文件资源管理器

4 个文件

SKILL.md

来源说明 · 只读预览

返回搜索返回安装

aws-remediation-leverage

Rank AWS remediations by how many attack chains each one severs, so a team gets maximum blast-radius reduction per fix. Use when you have an aws_attack_chains/v1 file from the chain enumerator and need to turn it into a prioritized "biggest bang for the buck" remediation plan - which single control fix breaks the most kill chains and techniques, a severity-weighted leverage ranking, the crown jewels and accounts each fix protects, and a greedy do-in-this-order roadmap (marginal set-cover) showing how few fixes cover most of the attack surface, and a compounding matrix (which misconfiguration enables the next) so fixing the source control cuts a chain early. Final decision-support stage of the AWS red-team attack-chain suite.

2026-08-09

aws-attack-chain-enumerator

Traverse a merged aws_attack_model/v1 attack graph and emit aws_attack_chains/v1 - ranked kill chains from an entry (internet or a single stolen credential) to crown jewels, the atomic technique catalog of attack primitives actually present, and root causes rolled up by control. Use when turning a merged AWS attack model into scored attacker kill chains, an ATT&CK-mapped technique catalog, prioritized root causes, or the input a red-team report packager renders.

2026-08-09

aws-attack-graph-builder

Merge one or more aws_attack_model/v1 envelopes from the AWS attack-surface / identity-trust / crown-jewel / active-threat collectors into a single, de-duplicated attack graph ready for chain enumeration. Use when combining multiple collector outputs into one model, reconciling nodes and edges across accounts, validating that every edge references a real node, or producing the merged attack_model.json that aws-attack-chain-enumerator traverses.

2026-08-09

查看这个仓库的全部 Skills

AWS CloudTrail Lookup Collector

Use this skill for live CloudTrail management-event collection. It is customer-agnostic and requires explicit account/role/session configuration.

Quick Start

python3 ../../skills/aws/cloudtrail/lookup-collector/scripts/lookup_events.py \ --accounts accounts.json \ --event-names events.txt \ --regions us-east-1,us-west-2 \ --start 2026-04-01T00:00:00Z \ --end 2026-06-12T00:00:00Z \ --output cloudtrail_lookup_out

Account Config

accounts.json is an array:

[ {"account_id": "123456789012", "role_arn": "arn:aws:iam::123456789012:role/ReadOnlySecurityRole", "profile": "optional-source-profile"} ]

If role_arn is omitted, the script uses the current boto3 session credentials. If profile is present, it uses that profile before assuming the role.

Rules

Record every lookup call in lookup_calls.json.

Include an AWS CLI equivalent for every call.

Capture errors and capped queries; do not hide partial collection.

Keep raw lookup responses separately from normalized observations.

Prefer narrow event-name lookups for high-signal management events; CloudTrail LookupEvents is query-limited and not a full data-event lake.

Outputs

raw_lookup_events.json

raw_cloudtrail_events.json

lookup_calls.json

normalized_observations.jsonl

manifest.json

Use this skill with aws-cloudtrail-normalize-observations when normalizing pre-existing CloudTrail files rather than making live AWS calls.

name

aws-cloudtrail-lookup-collector

description