aws-summarize-account-activity
Analyzes CloudTrail data of a given AWS account and generates a summary of recently active IAM principals, API calls they made, as well as regions, IP addresses and user agents they used. The summary is written to a JSON output file and can optionally be visualized as PNG files. Usage: - Make sure you have AWS credentials configured for your target account. - This can either be done using environment variables or by specifying a named profile in the optional --profile argument. Example run: - pip install -r requirements.txt - python aws_summarize_account_activity.py Supported arguments: - All arguments are optional: --activity-type {ALL,SUCCESSFUL,FAILED}: type of CloudTrail data to analyze: all API calls (default), only successful API calls, or only API calls that AWS declined with an error message --dump-raw-cloudtrail-data: store a copy of all gathered CloudTrail data in JSONL format --past-hours HOURS: hours of CloudTrail data to look back and analyze default: 336 (=14 days), minimum: 1, maximum: 2160 (=90 days) --plot-results: generate PNG files that visualize the JSON output file --profile PROFILE: named AWS profile to use when running the command Notes: - The script requires AWS credentials to access the CloudTrail data.
FEATURES
ALTERNATIVES
Generate Amazon GuardDuty findings related to real AWS resources with multiple tests available.
A set of tools for fingerprinting and exploiting Amazon cloud infrastructures
Azure Guardrails enables rapid enforcement of cloud security guardrails by generating Terraform files for Azure Policy Initiatives.
A workload policy enforcement tool for Kubernetes with various supported policies and configuration options.
Grype is a vulnerability scanner for container images and filesystems that scans for known vulnerabilities and supports various image formats.
A command line tool that counts Amazon resources across regions and displays the results in a friendly format.
PINNED
InfoSecHired
An AI-powered career platform that automates the creation of cybersecurity job application materials and provides company-specific insights for job seekers.
Mandos Brief Newsletter
A weekly newsletter providing cybersecurity leadership insights, industry updates, and strategic guidance for security professionals advancing to management positions.
Kriptos
An AI-driven data classification and governance platform that automatically discovers, analyzes, and labels sensitive information while providing risk management and compliance capabilities.
System Two Security
An AI-powered platform that automates threat hunting and analysis by processing cyber threat intelligence and generating customized hunt packages for SOC teams.
Aikido Security
Aikido is an all-in-one security platform that combines multiple security scanning and management functions for cloud-native applications and infrastructure.
Permiso
Permiso is an Identity Threat Detection and Response platform that provides comprehensive visibility and protection for identities across multiple cloud environments.
Wiz
Wiz Cloud Security Platform is a cloud-native security platform that enables security, dev, and devops to work together in a self-service model, detecting and preventing cloud security threats in real-time.
Adversa AI
Adversa AI is a cybersecurity company that provides solutions for securing and hardening machine learning, artificial intelligence, and large language models against adversarial attacks, privacy issues, and safety incidents across various industries.