Spot suspicious access to your cloud storage.
What it does
Analyzes cloud storage access to produce prioritized findings on potentially suspicious activity.
When to use it
Use when investigating cloud storage security incidents, building detection rules, conducting threat hunts, or validating monitoring coverage.
How to use it
Ask it to analyze storage access, optionally specifying an S3 bucket and lookback period; it saves a JSON findings report.
Uses
Latest review
What you need · 3
Requires Python 3.8 or newer.
The bundled analyzer requires the AWS CLI to query CloudTrail.
Access · 4
This skill
CloudTrail
Read
Reads CloudTrail storage access events
boto3
Execute
Installs boto3