A specialized AI security analyst that detects threats, unauthorized changes, and MITRE ATT&CK patterns within AWS CloudTrail logs.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install cloudtrail-threat-detector
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install cloudtrail-threat-detector using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is AWS CloudTrail Threat Detector?
The AWS CloudTrail Threat Detector is a high-fidelity analysis tool designed for security engineers and DevOps professionals. As part of the Openclaw Skills ecosystem, it provides a privacy-conscious way to investigate cloud incidents by analyzing exported JSON log data rather than requesting direct access to AWS environments. This skill excels at correlating disparate API calls into a cohesive attack narrative, making it an essential component for teams looking to enhance their incident response capabilities with Openclaw Skills.
By focusing on instruction-based analysis, the skill identifies high-risk patterns such as root account usage, MFA-less console logins, and unauthorized credential creation. It bridges the gap between raw data and actionable security intelligence, ensuring that even complex multi-step attacks are mapped to the standard MITRE ATT&CK framework for better reporting and remediation.
AWS CloudTrail Threat Detector Use Cases
- Rapid forensic investigation after a suspected cloud breach or unauthorized access event.
- Periodic auditing of CloudTrail logs to identify stealthy persistence mechanisms or defense evasion tactics.
- Mapping cloud activity to the MITRE ATT&CK framework for compliance and board-level reporting.
- Identifying misconfigurations like public S3 buckets or overly permissive IAM policy attachments.
How AWS CloudTrail Threat Detector Works
- The user exports CloudTrail event data using the AWS CLI or S3 Console as JSON.
- The skill parses these events to identify the actors, actions, and target resources.
- It flags high-risk events that match known malicious patterns, such as stopping logs or creating new access keys.
- Related events are sequenced into a chronological Incident Timeline to reveal the attack path.
- Findings are categorized by severity and mapped to specific MITRE ATT&CK techniques.
- The tool generates a plain-English narrative and provides specific containment steps for the user.
AWS CloudTrail Threat Detector Setup
Since this is an instruction-only tool, no direct AWS credentials are required for the AI. You simply need to provide the log data. To export the necessary logs for analysis via Openclaw Skills, use the following command:
aws cloudtrail lookup-events --start-time 2025-03-15T00:00:00Z --end-time 2025-03-16T00:00:00Z --output json > cloudtrail-events.json
Ensure your local environment has the necessary read-only permissions such as cloudtrail:LookupEvents to perform the export.
AWS CloudTrail Threat Detector Data Schema & Taxonomy
The skill processes JSON-formatted CloudTrail events and produces a structured report organized as follows:
| Section | Description |
|---|---|
| Threat Summary | Aggregate count of Critical, High, and Medium findings |
| Incident Timeline | Chronological sequence of suspicious events and actions |
| Findings Table | Detailed list including Principal, Source IP, and MITRE Technique |
| Attack Narrative | A plain-English explanation of the attacker's suspected goals |
| Containment Actions | Immediate steps like revoking keys or isolating instances |
| Detection Gaps | Advice on missing CloudWatch alerts to prevent future incidents |
AWS CloudTrail Threat Detector Advanced Features
- IP Geolocation correlation to identify API calls originating from unexpected or high-risk regions.
- Detection of credential stuffing by analyzing patterns of failed API calls followed by successful authentication.
- Automated monitoring of root account usage to flag high-risk operational activities.
- Comprehensive mapping of cloud events to the specialized MITRE ATT&CK Cloud Matrix.
SKILL.md
Loading
Related Openclaw Skills
GCP BigQuery Cost Optimizer
A specialized analytical tool designed to audit Google Cloud BigQuery usage and slash unexpected costs through pattern analysis and storage optimization.
Azure Bandwidth Optimizer
A specialized AI tool for identifying and eliminating hidden Azure networking and data egress costs through intelligent data analysis.
AWS Anomaly Explainer
An automated AWS cost incident responder that translates complex billing spikes into actionable root cause analysis and containment steps.
Azure Activity Log & Sentinel Threat Detector
A sophisticated security analysis tool for identifying threat patterns and attack timelines within Azure Activity Logs and Sentinel data.
AWS Compliance Gap Analyzer
An expert analysis skill that maps exported AWS environment data against major compliance frameworks like CIS, SOC 2, HIPAA, and PCI-DSS.
GCP Committed Use Discount (CUD) Advisor
An expert analysis tool that identifies the optimal mix of Google Cloud commitments to maximize cost savings and minimize financial risk.
Featured*
