Cloudtrail AI Investigator — DevOps skill for Claude Code
AI agent that investigates AWS CloudTrail logs in plain English: writes SQL, runs it on Athena, explains suspicious activity with RAG, and plugs into Claude via MCP.
How to install Cloudtrail AI Investigator
This entry records only its repository, not the path inside it, so there is no
exact command to give. Open Iditc/cloudtrail-ai-investigator and copy the folder into
~/.claude/skills/, or the file into ~/.claude/agents/.
What Cloudtrail AI Investigator does
AI agent that investigates AWS CloudTrail logs in plain English: writes SQL, runs it on Athena, explains suspicious activity with RAG, and plugs into Claude via MCP. Includes model benchmarks and prompt-injection testing
Alternatives in DevOps
- Claude Code Router — Use Claude Code as the foundation for coding infrastructure, allowing you to decide how to interact with the m 30.1k ★
- AWS Skills Pack — AWS cloud services skills 1.6k ★
- Proxy — route Claude Code requests through multiple upstream providers (OpenCode Go, OpenCode Zen, and AWS Bedrock) wi 957 ★
README
CloudTrail AI Investigator
An AI agent that answers natural-language questions about AWS CloudTrail logs. It writes SQL, runs it on Athena, explains suspicious events with RAG, and is exposed to Claude Desktop through MCP.
Learning project covering: Agents, AWS (S3, Athena, IAM, Bedrock), MCP, LLM, RAG, and a vector DB.
Work in progress. Results, diagram and demo will be added as the project progresses.
Data
Public CloudTrail logs from [flaws.cloud](http://flaws.cloud) by Summit Route (20 files, 1,939,207 real events from 2017, including attack attempts).
Progress
- Day 1: AWS setup, logs in S3, Athena table
Related Skills
Data Model Skills Ty
Agentic, read-only database assistant for SQL Server and Azure SQL. Ask in plain English: the agent signs in,
SQL From Data Model Skill
Agentic, read-only database assistant for SQL Server and Azure SQL. Ask in plain English: the agent signs in,
Model Market Comparison
Compare open-source & frontier LLM prices across providers (OpenRouter, AWS Bedrock, Azure Foundry, GitHub Cop
P2P
Meta-prompt system that writes prompts: raw idea in — a polished, model-specific prompt out. Cross-model (Clau
Transilience Mdr Rainer
Claude Code skills for AWS MDR workflows: CloudTrail collection, evidence packaging, baselining, detection eng
Obsidian Web MCP
Secure remote MCP server for Obsidian vaults -- access your notes from Claude, your phone, or any MCP client,
Related Agents
Outreach Analyst
Campaign analyst. Reads one campaign's statistics and activity feed from Emelia, computes the rates on stated
CodeHelper
Explains broken or confusing code in plain language and proposes a minimal fix. USE WHEN code isn't working, e
Jev Analyst
Deep read-only analyst for Jev-routed subtasks. Investigates and explains behavior that spans many files (end-
