Aws Cloudtrail Log Normalizer

Name: Aws Cloudtrail Log Normalizer
Author: agentskillexchange

ASecurity

Normalizes and enriches AWS CloudTrail JSON logs into OCSF (Open Cybersecurity Schema Framework) format. Maps eventSource/eventName pairs to MITRE ATT&CK technique IDs using the MITRE ATT&CK STIX API.

36 stars
0 votes
0 copies
2 views
Added June 8, 2026

ai-agentsjavascriptgojavareactnodenodejsawsgitapisecurity

Works with

Security analysis

A92/100

mediumInstalls packages at runtime which could introduce malicious dependencies

Pro shows the line behind each finding and how to fix it

Scanned June 8, 2026

npx -y skills add agentskillexchange/skills --skill aws-cloudtrail-log-normalizer --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Aws Cloudtrail Log Normalizer?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Aws Cloudtrail Log Normalizer

[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/agentskillexchange-aws-cloudtrail-log-normalizer/badge)](https://www.skillsdirectory.com/skills/agentskillexchange-aws-cloudtrail-log-normalizer)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro

SKILL.md

---
name: "AWS CloudTrail Log Normalizer"
slug: "aws-cloudtrail-log-normalizer"
description: "Normalizes and enriches AWS CloudTrail JSON logs into OCSF (Open Cybersecurity Schema Framework) format. Maps eventSource/eventName pairs to MITRE ATT&CK technique IDs using the MITRE ATT&CK STIX API."
github_stars: 3607
verification: "security_reviewed"
source: "https://github.com/aws/aws-sdk-js-v3"
category: "Security & Verification"
framework: "Custom Agents"
tool_ecosystem:
  github_repo: "aws/aws-sdk-js-v3"
  github_stars: 3607
---

# AWS CloudTrail Log Normalizer

Normalizes and enriches AWS CloudTrail JSON logs into OCSF (Open Cybersecurity Schema Framework) format. Maps eventSource/eventName pairs to MITRE ATT&CK technique IDs using the MITRE ATT&CK STIX API.

## Installation

Use the upstream install or setup path that matches your environment:
- Let’s walk through setting up a project that depends on DynamoDB from the SDK and makes a simple service call. The following steps use yarn as an example. These steps assume you have Node.js and yarn already installed.
- git clone https://github.com/aws/aws-sdk-js-v3.git
- yarn && yarn test:all
- yarn pack .

Requirements and caveats from upstream:
- To test your universal JavaScript code in Node.js, browser and react-native environments,
- [Node.js and ECMAScript Version Support Policy](#nodejs-and-ecmascript-version-support-policy)
- Create a new Node.js project.

Basic usage or getting-started notes:
- [Getting Started](#getting-started)
- Inside of the project, run: yarn add @aws-sdk/client-dynamodb. Adding packages results in update in lock file, [yarn.lock](https://yarnpkg.com/getting-started/qa/#should-lockfiles-be-committed-to-the-repository) or [p...
- Create a new file called index.js, create a DynamoDB service client and send a request.

- Source: https://github.com/aws/aws-sdk-js-v3
- Extracted from upstream docs: https://raw.githubusercontent.com/aws/aws-sdk-js-v3/HEAD/README.md

## Source

- [Agent Skill Exchange](https://agentskillexchange.com/skills/aws-cloudtrail-log-normalizer/)