Cloudtrail Python Packages

awsherlock

Open-source AWS security scanner for misconfigurations, multi-account environments, and standalone HTML reporting.

sigwood

Local-first threat hunting for the logs you already have: Zeek, Pi-hole, syslog or the systemd journal, CloudTrail. Every run names the technique behind each detector. No agent, no daemon, no black box - between grep and a SIEM.

historical

A serverless, event-driven AWS configuration collection service with configuration versioning.

bedrock-keys-security

Detect phantom IAM users, decode leaked AWS Bedrock and Claude Platform API keys, and prevent LLMjacking. CLI + SCPs + SIEM detection rules.

trailscraper

A command-line tool to get valuable information out of AWS CloudTrail

scope-forensics

Scope is an open source cloud forensic tool to conduct rapid incident response in Amazon Web Services (AWS).

secureaws

This package will scan your AWS account to identify whether basic security services are enabled. If not, will help you enable the same.

aws-cloudtrail-events-schema

The structure of the events from CloudTrail are similar to responses seen when using boto3. Boto3 is powered by the botocore library. The botocore library contains a data directory that describes the API calls (requests and responses). This library allows you to interact with the data directories of botocore to see the API request and responses. This is to help you write custom AWS Config rules and or CloudCustodian policies.

sigwood-cli

Local-first threat hunting for the logs you already have: Zeek, Pi-hole, syslog or the systemd journal, CloudTrail. Every run names the technique behind each detector. No agent, no daemon, no black box - between grep and a SIEM.