| name | aws-cloudtrail-business-baseline |
| description | Build business-as-usual baselines from normalized AWS CloudTrail observations. Use when analyzing AWS control-plane activity to understand normal business operations, actor/event/source-IP tuples, account behavior, application communication patterns, CI/CD deployment patterns, user access, identity changes, storage/KMS, network changes, database operations, or alertable deviations from prior CloudTrail activity. |
AWS CloudTrail Business Baseline
Use this skill after aws-cloudtrail-normalize-observations to turn normalized CloudTrail observations into a business operating model.
Quick Start
python3 ../../skills/aws/cloudtrail/business-baseline/scripts/build_business_baseline.py \
--observations normalized_observations.jsonl \
--output baseline.json
Optional inputs:
--account-inventory accounts.json--resource-inventory resources.json--customer "Customer Name"
Workflow
- Normalize CloudTrail first.
- Build account, actor/event/source-IP, and business-family aggregates.
- Review the caveats in the baseline metadata before using it for suppression.
- Use baseline recurrence as context, not approval. Critical visibility, identity, destructive, and exposure events stay alertable.
Business Families
Use the bundled script’s family mapping unless the customer has a better taxonomy:
- CI/CD and deployment automation
- Application and AWS service-to-service communication
- Human, SSO, and console access
- Identity and privilege management
- Storage, data, and KMS operations
- Network and perimeter security changes
- Security governance and visibility
- Database operations
- Operations and maintenance
- Other control-plane activity
Output
The baseline JSON contains:
metadataoverallaccountsbusiness_familiesactor_event_baselinealert_candidates
Use references/baseline_schema.md for the exact interface.
