Results for “aws-detective”

Analyze AWS GuardDuty findings, detectors, suppression rules, and member accounts with parallel execution and anti-hallucination guardrails.

Deep-dive analysis of AWS RDS instances using Performance Insights, event subscriptions, proxy health, and global database status, with parallel execution and anti-hallucination guardrails.

Deploy and operationalize Amazon GuardDuty for continuous threat detection across AWS accounts and workloads, including enabling protection plans, interpreting findings, and building automated response workflows.

Automate AWS GuardDuty threat detection findings processing using EventBridge and Lambda to enable real-time incident response, automatic quarantine of compromised resources, and security notification workflows.

Diagnoses AWS architecture issues and reviews Well-Architected pillars using read-only AWS CLI commands, with confirmation required for any changes.

Analyze AWS resource health, diagnose issues from CloudWatch logs and metrics, and create a remediation plan for identified problems.

Reads the local AWS configuration to determine the active profile, region, account ID, and caller identity before any AWS task, avoiding guesswork and preventing common deployment errors.

Investigate production incidents using CloudWatch Logs Insights query templates, alarm-to-deployment correlation, blast-radius narrowing decision tree, and PromQL-style metric query patterns.

Reviews AWS infrastructure as code and deployed resources against the Well-Architected Framework, generating findings and GitHub issues for remediation.

Analyzes AWS CloudTrail events and trails, including trail health, API activity, security investigations, resource changes, and event selector audits, with parallel execution and anti-hallucination guardrails.

Investigate AWS account compromises by querying CloudTrail logs to reconstruct attacker activity, identify compromised credentials, and analyze API call patterns.

Scan source code repositories, CI/CD pipelines, and configuration files for exposed AWS credentials using TruffleHog, git-secrets, and AWS-native detection mechanisms to prevent credential theft and unauthorized account access.

Analyzes AWS Lambda functions, including configuration, invocation metrics, cold starts, error rates, layers, and concurrency, producing structured reports.

Analyzes AWS WAF web ACLs, rules, IP sets, and logging configurations, and retrieves blocked/allowed request metrics from CloudWatch.

Collect and analyze logs, snapshots, and metadata from AWS, Azure, and GCP to investigate security breaches in cloud environments.

Identify AWS IAM privilege escalation paths by analyzing policies for dangerous permission combinations and least-privilege violations using boto3 and Cloudsplaining-style analysis.

Analyze AWS CloudTrail logs for security monitoring, threat detection, and forensic investigation using Athena, CloudWatch Logs Insights, and SIEM integration.

Operates AWS resources directly through the AWS CLI, covering S3, EC2, Lambda, and CloudFormation. Activates when AWS-related terms are mentioned and enforces confirmation for write operations.

Detect compromised cloud credentials across AWS, Azure, and GCP by analyzing anomalous API activity, impossible travel patterns, unauthorized resource provisioning, and credential abuse indicators using GuardDuty, Defender for Identity, and SCC Event Threat Detection.

Detect and respond to unauthorized cryptocurrency mining in AWS and Azure environments using cost anomalies, compute utilization, network traffic analysis, and runtime monitoring.

Analyzes AWS billing and suggests cost optimization strategies for EC2, RDS, S3, and Lambda

Detonate granular AWS, Azure, GCP, and Kubernetes attack techniques to validate detections with Stratus Red Team.

Operate and extend barretlee/agent-pulse, the evidence-backed AI industry intelligence system: inspect source catalog and lifecycle, collect and normalize signals, bind evidence, cluster Events, evaluate system health, generate Scout hypotheses, export the privacy-safe public site, and verify release gates. Use when the user asks to run, configure, debug, extend, or explain Agent Pulse, its collectors, Control Room, narratives, Scout, or GitHub Pages output. Triggers on: agent-pulse, Agent Pulse, evidence-backed intelligence, source catalog, signal collection, Event clustering, source audit, Scout opportunity, public export, weekly brief, or AI industry intelligence pipeline.

Query AWS CloudTrail events with boto3, build statistical baselines of normal API activity, and detect anomalies such as unusual event sources, geographic anomalies, high-frequency API calls, and first-time API usage patterns.

Analyzes AWS Glue ETL jobs, crawlers, Data Catalog, and schema registry using parallel AWS CLI queries with anti-hallucination guardrails.

AWS infrastructure management — EKS, ECR, VPC, RDS, ElastiCache, S3, Route53, ACM, Secrets Manager, CloudWatch, IAM

Use Pacu modules for AWS privilege escalation, persistence, and backdooring during authorized penetration tests.

Analyzes AWS CloudFront distributions, including cache hit ratios, origin health, SSL certificate status, and invalidation history, producing structured reports.

Detect lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL hunting queries, and sign-in anomaly correlation to identify privilege escalation, token theft, and cross-tenant pivoting.

Analyzes AWS SES sending statistics, bounce and complaint rates, identity management, configuration sets, and deliverability tracking using the SES v2 API.

Analyzes AWS Cognito user pools and identity pools, covering authentication flows, MFA status, app client configuration, password policy, Lambda triggers, and federation setup.

Analyze AWS Config compliance and resource configuration with parallel execution and anti-hallucination guardrails.

Analyzes AWS S3 buckets for storage class distribution, lifecycle policies, access patterns, and cost optimization, including security posture checks like encryption and public access.

Analyzes AWS X-Ray traces and service maps, including fault and error analysis, latency investigation, sampling rule review, and group configuration.

Analyzes AWS billing data with anti-hallucination guardrails, covering cost breakdowns, trends, anomaly detection, RI/SP utilization, forecasting, and multi-account comparisons using Cost Explorer.