Skip to content
Get packs

Cloud Storage Access Pattern Analyzer

Spot unusual access to AWS S3, GCS and Azure Blob storage that could signal data theft.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

Once installed, the agent can review logs of who accessed cloud storage buckets and flag suspicious patterns, such as large downloads outside business hours, access from IP addresses not seen before, or sudden bursts of object-listing requests. It explains the procedure to follow and can run a bundled Python script that pulls recent AWS CloudTrail events for a bucket and writes a JSON report. The findings are meant to help security analysts prioritize investigations.

Great for

  • Security analysts investigating a suspected data leak from cloud storage
  • Cloud engineers building detection rules or threat-hunting queries for S3, GCS or Azure Blob
  • Teams validating whether their logging covers cloud data exfiltration techniques

Skip it if

  • People without access to their own cloud logs or authorization to review them, since it reads sensitive access records
  • Real-time blocking or prevention: it analyzes past events and does not stop access
  • Production use without review: the bundled script is an excerpt, its GCS and Azure logic is not shown, and its thresholds are fixed rules of thumb

Try asking

  • “Analyze the last 24 hours of CloudTrail data events for my sensitive-data bucket and flag bulk downloads”
  • “Check our S3 bucket for access from IP addresses we have not seen in the past 30 days”
  • “Write a detection rule for after-hours GetObject spikes in Azure Blob Storage logs”
  • “Help me triage a suspected exfiltration from our GCS bucket using its audit logs”
Step-by-step guide: how to use Cloud Storage Access Pattern AnalyzerInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    analyzing-cloud-storage-access-patterns.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-cloud-storage-access-patterns.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-cloud-storage-access-patterns.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Run it against a test or lab bucket first and confirm the output matches what you expect before using it on production logs
  • Treat the fixed thresholds (100 GetObject calls per hour, 30-day IP history, 8am-6pm hours) as starting points and tune them to your environment
  • Use read-only, least-privilege AWS credentials and keep the generated report within your incident response process because it contains access details

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.