orca-investigate

# Orca Investigate Skill Answers the question: **"What happened, who did it, and how far did they get?"** Given an actor (IAM identity), source IP, target resource, or suspicious event, traces activity through Orca CDR (CloudTrail/audit logs), builds a session timeline, maps actions to MITRE ATT&CK techniques, clusters related sessions, and assesses the blast radius. ## Usage ``` /orca-investigate arn:aws:iam::123456789012:role/bastion-admin-role /orca-investigate 10.0.1.50 /orca-investigate account 123456789012 ``` Or natural language: - "investigate what this role did in the last 24 hours" - "trace activity from IP 10.0.1.50" - "what happened in this account today?" - "investigate suspicious AssumeRole events" - "who accessed the prod database?" - "incident investigation for orca-3636513" ## Processing Logic ### Step 1: Determine Investigation Scope Parse user input to determine the investigation axis: | Input Pattern | Primary Filter | CDR Parameter | |--------------|---------------|---------------| | ARN (actor) | Identity-based | `actors: ["<ARN>"]` | | IP address | Source-based | `source_ip_addresses: ["<IP>"]` | | Resource ARN/name | Target-based | `targets: ["<resource>"]` | | Account ID | Account-wide | `accounts: ["<account>"]` | | Event/action name | Action-based | `actions: ["<action>"]` | | Alert ID (orca-XXXX) | Alert-initiated | Fetch alert, extract actor/target, then CDR | | Service name | Service-based | `services: ["<service>"]` | Determine time ra...