> For the complete documentation index, see [llms.txt](https://blog.micsoftvn.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.micsoftvn.com/use-cases/for-security/tools/tools-for-aws.md).

# Tools for AWS

A few tools usesd for AWS

<table><thead><tr><th></th><th width="379"></th></tr></thead><tbody><tr><td>URL</td><td>Content</td></tr><tr><td>https://github.com/ThreatResponse/aws_ir</td><td>AWS_IR: is a Python CLI tool used toautomate initial response actions</td></tr><tr><td>https://github.com/ThreatResponse/margaritashotgun</td><td>Margarita Shotgun is used to dump<br>memory from systems</td></tr><tr><td>https://www.sans.org/tools/sift-workstation/</td><td>SANS Investigative Forensic Toolkit<br>is an all-in-one forensic toolkit</td></tr><tr><td>https://github.com/Netflix-Skunkworks/diffy</td><td>Diffy is a tool for identifying changes<br>or differences in systems</td></tr><tr><td>https://github.com/aws-solutions/automated-forensic-orchestrator-for-amazon-ec2</td><td>Automatic Forensics Orchestrator<br>collects full snapshots of EC2 systems</td></tr><tr><td>https://github.com/osquery/osquery</td><td>OSQuery is an endpoint detection<br>and response tool</td></tr><tr><td>https://www.sans.org/tools/sof-elk/</td><td>SOF-ELK is an analytics platform focused<br>on the needs of computer forensics<br>and investigation teams</td></tr><tr><td>https://github.com/prowler-cloud/prowler</td><td>Prowler is a multi-purpose toolkit</td></tr><tr><td>https://github.com/keikoproj/kube-forensics</td><td>kube-forensics is used to dump<br>the running pod and all its containers</td></tr><tr><td>https://github.com/invictus-ir/Invictus-AWS</td><td>Invictus-AWS automatically enumerates<br>and acquires relevant data</td></tr></tbody></table>