Investigate AWS security incidents using Amazon Detective's behavior graphs, built from CloudTrail, VPC Flow Logs, GuardDuty, and EKS audit logs, to trace entity timelines and profile IAM users, roles, EC2 instances, and IP addresses for lateral movement.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-cloud-native-threat-hunting-with-aws-detectivenpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-cloud-native-threat-hunting-with-aws-detective -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-cloud-native-threat-hunting-with-aws-detective -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/performing-cloud-native-threat-hunting-with-aws-detectivegh skill install mukul975/Anthropic-Cybersecurity-Skills performing-cloud-native-threat-hunting-with-aws-detectivegit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/performing-cloud-native-threat-hunting-with-aws-detective ~/.claude/skills/performing-cloud-native-threat-hunting-with-aws-detective # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/performing-cloud-native-threat-hunting-with-aws-detective ~/.agents/skills/performing-cloud-native-threat-hunting-with-aws-detective # Codex, Cursor, Gemini CLI, Copilot, OpenCode