enrich-with-aws-security-agent

Name: enrich-with-aws-security-agent
Author: aws-samples

25stars20forks

How to install enrich-with-aws-security-agent?

aws-samples/sample-devops-agent-tools/enrich-with-aws-security-agent

$npx -y skills add aws-samples/sample-devops-agent-tools --skill enrich-with-aws-security-agent

Installs into the current project.

Summary

Automatically load this skill when investigating application outages, service degradation, or errors that could have security-related root causes — including unexplained downtime, authentication or authorization failures, injection attacks, data exposure, or suspicious applicatio

Files · 1

View on GitHub

SKILL.md

1	# Enriching Investigations with AWS Security Agent Findings
2
3	## When to Use — AUTOMATIC ACTIVATION
4
5	Load this skill automatically when ANY of these conditions apply:
6
7	### Application-Level Symptoms (even without explicit security context)
8	- Application pages or endpoints are not loading or returning errors
9	- Unexplained service outages with no recent deployments
10	- Application behaving unexpectedly without clear infrastructure cause
11	- Services returning 4xx/5xx errors without obvious resource exhaustion
12
13	### Explicit Security Signals
14	- Security vulnerabilities or misconfigurations mentioned
15	- Suspicious code patterns or behaviors observed
16	- Authentication or authorization failures
17	- Injection vulnerabilities suspected (SQL, command, SSRF, etc.)
18	- Sensitive data exposure concerns
19	- Security-related errors in application logs
20	- Findings that suggest code-level security issues
21
22	### Key Insight
23	Many security issues (like SSRF, injection attacks, or compromised dependencies) manifest as application outages or errors rather than obvious security alerts. When an app stops working and there's no clear infrastructure cause (no deployments, no resource exhaustion, no config changes), always check for security issues.
24
25	## Overview
26
27	AWS Security Agent is an AI-powered security service that performs automated code security reviews and penetration testing. Its findings are stored in CloudWatch Logs and provide detailed, actionable information about vulnerabilities including exact file locations, line numbers, and remediation guidance.
28
29	## Steps
30
31	1. Identify the relevant CloudWatch log group for AWS Security Agent findings. Look for log groups with patterns like:
32	- `/aws/securityagent/*`
33	- Log groups containing "security-agent" or "securityagent" in the name
34
35	2. Query the Security Agent logs using CloudWatch Logs Insights:
36	```
37	fields @timestamp, @message
38	\| filter @message like /finding\|vulnerability\|issue\|risk/
39	\| sort @timestamp desc
40	\| limit 100
41	```
42
43	3. Extract actionable details from the findings:
44	- File path: The exact source file containing the vulnerability
45	- Line number: The specific line(s) of code affected
46	- Vulnerability type: Classification (e.g., SQL injection, XSS, SSRF, hardcoded secrets)
47	- Severity: Critical, High, Medium, Low
48	- Description: What the vulnerability is and why it's a risk
49	- Remediation: Suggested fix or mitigation
50
51	4. Correlate findings with the incident by matching:
52	- Affected services or components
53	- Timeframes (when the vulnerability was introduced vs. when the incident occurred)
54	- Code paths involved in the failing functionality
55
56	5. Present findings to the customer with:
57	- Clear identification of the vulnerable code location
58	- Explanation of how this vulnerability may relate to the incident
59	- Specific remediation steps they can take to fix the code
60
61	## Example Log Query for Specific Application
62
63	If investigating a specific application (e.g., "ssrf-demo", "orders", "account"):
64	```
65	fields @timestamp, @message
66	\| filter @message like /ssrf\|orders\|account\|vulnerability\|finding\|issue/
67	\| sort @timestamp desc
68	\| limit 50
69	```
70
71	## Important Notes
72
73	- AWS Security Agent API access may require additional IAM permissions. If API calls fail, fall back to the CloudWatch logs approach.
74	- Always provide the exact file and line number when available — this is the key value for customers.
75	- Link the security finding to the observed incident behavior when possible.
76	- When in doubt, check security logs — it's better to rule out security issues than to miss them.

People who liked this also viewed

6 picks

Type

enrich-with-aws-security-agent

25stars20forks

View on GitHub

How to install enrich-with-aws-security-agent?

aws-samples/sample-devops-agent-tools/enrich-with-aws-security-agent

$npx -y skills add aws-samples/sample-devops-agent-tools --skill enrich-with-aws-security-agent

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Enriching Investigations with AWS Security Agent Findings
2
3	## When to Use — AUTOMATIC ACTIVATION
4
5	Load this skill automatically when ANY of these conditions apply:
6
7	### Application-Level Symptoms (even without explicit security context)
8	- Application pages or endpoints are not loading or returning errors
9	- Unexplained service outages with no recent deployments
10	- Application behaving unexpectedly without clear infrastructure cause
11	- Services returning 4xx/5xx errors without obvious resource exhaustion
12
13	### Explicit Security Signals
14	- Security vulnerabilities or misconfigurations mentioned
15	- Suspicious code patterns or behaviors observed
16	- Authentication or authorization failures
17	- Injection vulnerabilities suspected (SQL, command, SSRF, etc.)
18	- Sensitive data exposure concerns
19	- Security-related errors in application logs
20	- Findings that suggest code-level security issues
21
22	### Key Insight
23	Many security issues (like SSRF, injection attacks, or compromised dependencies) manifest as application outages or errors rather than obvious security alerts. When an app stops working and there's no clear infrastructure cause (no deployments, no resource exhaustion, no config changes), always check for security issues.
24
25	## Overview
26
27	AWS Security Agent is an AI-powered security service that performs automated code security reviews and penetration testing. Its findings are stored in CloudWatch Logs and provide detailed, actionable information about vulnerabilities including exact file locations, line numbers, and remediation guidance.
28
29	## Steps
30
31	1. Identify the relevant CloudWatch log group for AWS Security Agent findings. Look for log groups with patterns like:
32	- `/aws/securityagent/*`
33	- Log groups containing "security-agent" or "securityagent" in the name
34
35	2. Query the Security Agent logs using CloudWatch Logs Insights:
36	```
37	fields @timestamp, @message
38	\| filter @message like /finding\|vulnerability\|issue\|risk/
39	\| sort @timestamp desc
40	\| limit 100
41	```
42
43	3. Extract actionable details from the findings:
44	- File path: The exact source file containing the vulnerability
45	- Line number: The specific line(s) of code affected
46	- Vulnerability type: Classification (e.g., SQL injection, XSS, SSRF, hardcoded secrets)
47	- Severity: Critical, High, Medium, Low
48	- Description: What the vulnerability is and why it's a risk
49	- Remediation: Suggested fix or mitigation
50
51	4. Correlate findings with the incident by matching:
52	- Affected services or components
53	- Timeframes (when the vulnerability was introduced vs. when the incident occurred)
54	- Code paths involved in the failing functionality
55
56	5. Present findings to the customer with:
57	- Clear identification of the vulnerable code location
58	- Explanation of how this vulnerability may relate to the incident
59	- Specific remediation steps they can take to fix the code
60
61	## Example Log Query for Specific Application
62
63	If investigating a specific application (e.g., "ssrf-demo", "orders", "account"):
64	```
65	fields @timestamp, @message
66	\| filter @message like /ssrf\|orders\|account\|vulnerability\|finding\|issue/
67	\| sort @timestamp desc
68	\| limit 50
69	```
70
71	## Important Notes
72
73	- AWS Security Agent API access may require additional IAM permissions. If API calls fail, fall back to the CloudWatch logs approach.
74	- Always provide the exact file and line number when available — this is the key value for customers.
75	- Link the security finding to the observed incident behavior when possible.
76	- When in doubt, check security logs — it's better to rule out security issues than to miss them.

People who liked this also viewed

6 picks

Type