53 个 · 按相关度排序
Analyze AWS CloudTrail logs against normal activity patterns to spot unusual API calls, IP addresses, errors, and sensitive changes. Produce a JSON report with anomaly scores, suspicious users, and suggested investigation steps.
中文简介正在准备中。当前显示英语简介。
Set up AWS CloudTrail to record activity across accounts, protect audit logs, and alert on sensitive operations. Includes guidance for querying past events with Athena or CloudTrail Lake and checking log integrity during investigations.
中文简介正在准备中。当前显示英语简介。
Assess serverless functions, primarily AWS Lambda, for unsafe execution of external input and unauthorized changes to code or added libraries. Combine source inspection, activity logs, and permission reviews to identify injection risks and recommend detection and prevention measures.
中文简介正在准备中。当前显示英语简介。
Analyze access logs from AWS S3, GCS, and Azure Blob Storage to spot unusual downloads, unfamiliar IP addresses, and request spikes. Compare activity with normal patterns and prioritize findings for suspected data theft investigations.
中文简介正在准备中。当前显示英语简介。
Investigate AWS production incidents using reusable CloudWatch log queries and metric calculations. Narrow affected resources, compare alarms with deployment events, and reconstruct a timeline to identify changes that may explain the symptoms.
中文简介正在准备中。当前显示英语简介。
Investigate suspected data theft from AWS S3 by comparing access logs, GuardDuty findings, and Macie classifications. Identify unusual bulk downloads and transfers across accounts, assess sensitive data exposure, and build automated detection rules.
中文简介正在准备中。当前显示英语简介。
Set up decoy credentials, storage, and secrets across AWS, Azure, and GCP to detect suspicious access. Connect audit logs to security alerts, verify detection, and document permissions, resource inventories, and maintenance plans.
中文简介正在准备中。当前显示英语简介。
Respond to security incidents across AWS, Azure, and GCP by investigating audit logs, containing compromised identities, isolating resources, and preserving evidence. Organize recovery and follow-up security measures for credential leaks, unauthorized permission changes, and attacks spanning cloud services.
中文简介正在准备中。当前显示英语简介。
Estimate AWS costs before deployment, analyze spending trends, and investigate metrics and logs with CloudWatch. The skill guides cost reviews, alert setup, and operational improvements through connected tools, with additional integrations for audits and security assessments.
中文简介正在准备中。当前显示英语简介。
Use Stratus Red Team to simulate attack techniques across AWS, Azure, GCP, and Kubernetes. Prepare test resources, run and repeat simulations, check logs and alerts, and remove resources to assess whether security detections work.
中文简介正在准备中。当前显示英语简介。
Use when the user asks to query Volcengine CloudTrail audit logs, investigate login or resource operations, or manage CloudTrail trails and backfill delivery tasks. Trigger on 操作审计, 审计日志, CloudTrail, cloud_trail, trail, 跟踪, 历史补投, or backfill in a Volcengine context. Audit queries are read-only; trail and backfill mutations require an explicit preview and confirmation.
中文简介正在准备中。当前显示原文说明。
Deploy cloud-native deception across AWS, Azure, and GCP using decoy (honey) resources whose only purpose is to generate a high-fidelity alert the instant an attacker touches them: canary IAM access keys, permission-less decoy users/roles/service principals, honey object-storage buckets, and decoy secrets in Secrets Manager / Key Vault / Secret Manager. Wires detection through CloudTrail + EventBridge, Azure Sentinel honeytoken watchlists + Defender, and GCP Cloud Audit Logs, so any use of a decoy is routed to the SOC with near-zero false positives. Use when protecting cloud accounts and data stores, when an org has only on-prem honeypots and needs cloud coverage, when seeding fake AWS keys to catch credential theft and code-leak exposure, or when detecting cloud reconnaissance and lateral movement. Keywords: cloud deception, canary token AWS, honey S3 bucket, decoy IAM credentials, CloudTrail alert, GuardDuty, Sentinel honeytoken, decoy secret, honey service account, cloud honeypot, breach detection.
中文简介正在准备中。当前显示原文说明。
Detect unusual API call patterns in AWS CloudTrail logs using boto3, statistical baselining, and behavioral analysis to identify credential compromise, privilege escalation, and unauthorized resource access.
中文简介正在准备中。当前显示原文说明。
Use when working with Aws Cloudtrail — aWS CloudTrail event analysis, trail management, insight event investigation, and organization trail configuration. Covers API activity analysis, security event investigation, resource change tracking, unauthorized access detection, and event history querying.
中文简介正在准备中。当前显示原文说明。
Perform forensic investigation of AWS environments using CloudTrail logs to reconstruct attacker activity, identify compromised credentials, and analyze API call patterns.
中文简介正在准备中。当前显示原文说明。
tespit etmeunusual API call patterns in AWS CloudTrail logs using boto3, statistical baselining, and behavioral analysis to identify credential compromise, privilege escalation, and unauthorized resource access.
中文简介正在准备中。当前显示原文说明。
Detect unusual API call patterns in AWS CloudTrail logs using boto3, statistical baselining, and behavioral analysis to identify credential compromise, privilege escalation, and unauthorized resource access.
中文简介正在准备中。当前显示原文说明。
Detect unusual API call patterns in AWS CloudTrail logs using boto3, statistical baselining, and behavioral analysis to identify credential compromise, privilege escalation, and unauthorized resource access.
中文简介正在准备中。当前显示原文说明。
Detect unauthorized cryptocurrency mining in cloud workloads by combining billing changes, CPU usage, mining pool connections, and process alerts. Follow workflows to preserve evidence, isolate affected resources, and trace how attackers gained access.
中文简介正在准备中。当前显示英语简介。
Check AWS S3 buckets and IAM roles against documented compliance rules. Identify public exposure, missing tags, and overly broad permissions, trace changes through audit logs, and prepare remediation requests for human review without applying fixes.
中文简介正在准备中。当前显示英语简介。
Enables a multi-region AWS CloudTrail trail with S3 log storage, CloudWatch Logs integration, and CloudWatch Logs Insights queries for security monitoring and compliance auditing. Use when setting up centralized API activity logging across all AWS regions.
中文简介正在准备中。当前显示原文说明。
Deploys, queries, and debugs AWS Marketplace usage-based (PAYG) metering — the pipeline (ResolveCustomer, BatchMeterUsage, EventBridge via SAM) and querying/debugging metering records, statuses, failures, discrepancies. Covers Concurrent Agreements (CustomerAWSAccountId + LicenseArn), multi-product, CloudTrail Event History (90 days; never CloudTrail Lake), Seller Reports (Billed Revenue/Usage columns + CSV/SDDS parsing), existing-stack detection, metering region for BatchMeterUsage/MeterUsage (DisabledApiException), metered AMI/Container + IAM roles, where registration data lives (customer-profile table), legacy ProductCode + CustomerIdentifier, DuplicateRecord/CustomerNotSubscribed, bad LicenseArn. Also SCOPES adjacent asks — flat-rate/SaaS-Subscription "do I still meter", CCP included-units + overage, contract term/annual renewal, forecasting future bills/usage — with the right answer or a one-line redirect. Use for any BatchMeterUsage/ResolveCustomer or SaaS usage-billing question.
中文简介正在准备中。当前显示原文说明。
Configure AWS CloudTrail for audit logging. Set up organization trails and event analysis. Use when auditing AWS activity.
中文简介正在准备中。当前显示原文说明。
AWS cost optimization, monitoring, and operational excellence expert. Use when analyzing AWS bills, estimating costs, setting up CloudWatch alarms, querying logs, auditing CloudTrail activity, or assessing security posture. Essential when user mentions AWS costs, spending, billing, budget, pricing, CloudWatch, observability, monitoring, alerting, CloudTrail, audit, or wants to optimize AWS infrastructure costs and operational efficiency.
中文简介正在准备中。当前显示原文说明。