Converts raw AWS GuardDuty security findings into human-readable incident summaries and prioritized response playbooks.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install guardduty-explainer
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install guardduty-explainer using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is AWS GuardDuty Explainer?
The AWS GuardDuty Explainer is a specialized security analysis tool designed to bridge the gap between complex JSON security logs and actionable human intelligence. As part of the Openclaw Skills library, this skill helps security teams quickly interpret threats like unauthorized access, crypto-mining, and exfiltration without needing deep AWS CLI expertise. It provides a safe, instruction-only environment where Claude analyzes exported security data to generate immediate action plans, ensuring your cloud infrastructure remains secure and compliant.
AWS GuardDuty Explainer Use Cases
- Rapidly interpreting high-severity AWS GuardDuty JSON logs during an active incident.
- Generating professional incident reports for stakeholders using plain-English summaries.
- Assessing the likelihood of false positives in automated security alerts.
- Mapping AWS security findings to the MITRE ATT&CK framework for compliance and threat modeling.
- Creating step-by-step remediation playbooks for junior SOC analysts to follow.
How AWS GuardDuty Explainer Works
- The user provides raw GuardDuty finding JSON or console export data to the agent.
- The skill parses the JSON to extract critical data points including finding type, severity, affected resources, and the actor involved.
- It generates a plain-English explanation of the security event, detailing the potential impact and danger level.
- The system assesses the likelihood of a false positive and maps the event to specific MITRE ATT&CK techniques.
- A prioritized response playbook is generated, featuring specific containment, investigation, and remediation steps.
- Necessary AWS CLI commands for isolation or credential revocation are provided for manual execution.
AWS GuardDuty Explainer Setup
To use this skill from the Openclaw Skills collection, ensure you have the necessary read-only permissions in your AWS environment. Use the following commands to gather finding data for analysis:
# List active findings with severity >= 4
aws guardduty list-findings \
--detector-id $(aws guardduty list-detectors --query 'DetectorIds[0]' --output text) \
--finding-criteria '{\"Criterion\":{\"severity\":{\"Gte\":4}}}' \
--output json
# Get details for a specific finding
aws guardduty get-findings \
--detector-id $(aws guardduty list-detectors --query 'DetectorIds[0]' --output text) \
--finding-ids <finding-id> \
--output json
AWS GuardDuty Explainer Data Schema & Taxonomy
The skill processes GuardDuty finding JSON objects and organizes the output into a structured report format:
| Component | Description |
|---|---|
| Finding Metadata | Type, Severity, Resource ID, and Actor IP/IAM User |
| Impact Analysis | Plain-English summary of the threat and its risks |
| Security Context | MITRE ATT&CK technique mapping and False Positive likelihood |
| Playbook | Ordered phases: Contain, Investigate, Remediate, and Harden |
| CLI Reference | Pre-formatted commands for manual remediation actions |
AWS GuardDuty Explainer Advanced Features
- Multi-finding bulk analysis for identifying large-scale attack patterns across the infrastructure.
- Automated mapping to the MITRE ATT&CK framework for standardized threat intelligence and reporting.
- Integrated if false positive pathing within every generated response playbook to avoid unnecessary downtime.
- Generation of Slack and PagerDuty-ready alert summaries with severity indicators for immediate team notification.
- Age-based escalation logic for findings older than 24 hours that haven't been addressed.
SKILL.md
Loading
Related Openclaw Skills
AWS FinOps Monthly Report Generator
Automate the generation of executive-ready AWS cost reports with detailed team-level chargeback and actionable savings insights.
Azure Entra ID (IAM) Auditor
An expert AI security auditor for Microsoft Entra ID that identifies identity risks, over-privileged accounts, and access gaps using exported tenant data.
Azure Dev/Test Optimizer
An AI-driven analysis tool designed to eliminate after-hours Azure development and testing waste through data-backed recommendations.
Azure Defender Posture Reviewer
An AI-powered security analyst that transforms raw Microsoft Defender for Cloud data into a prioritized, CISO-ready remediation roadmap.
AWS IAM Policy Auditor
Automate the detection of over-privileged AWS IAM policies and generate secure, least-privilege replacements to prevent cloud breaches.
AWS Idle & Zombie Resource Detector
A professional-grade cloud hygiene tool that scans AWS environments to identify and report on idle or orphaned resources generating unnecessary costs.
Featured*
