Demo on recorded data — install Watch free
NowDemo accountsLast event 0 s agoLast full scan 6 min agoSign out
What Firekeeper can and cannot see

Last full scan 09:54 UTC (6 min ago) across 2 accounts, 17 regions and 3 clusters. Firekeeper cannot see: Object reads on 2 of 3 sensitive buckets; One cluster's audit log.

AI agent on: $3.78 of $15 spent today

Ask Firekeeper

Open the full chat

Ask in plain words. Ask it to stop something and it shows the plan, ready to sign.

Needs you 1

  1. Now
    An attack is in progress; the response is being prepared.

    The plan will be ready in seconds. Waiting 6 min 12 s

    Look

Handled by Firekeeper 3

  1. Investigating

    Investigating the case.

    9 facts confirmed so far.

  2. Hunting

    Watching your other account for the same keys and tooling.

    Not seen there in the last 24 hours.

  3. Triaged

    Cleared 31 routine alerts as normal activity.

    Each matches your usual activity; all are still on Findings.

What Firekeeper is doing now live

Event lane
last event 0 s ago
Agent jobs today
investigating 5, automatic 2, hunting 1, triage 1
  1. investigating

    Found another key, ending 0003, made for ‹ci-deploy-b0t›.

    A second look at the fake user listed its keys.

  2. hunting

    Checked your other account for the same keys and tooling: not seen in 24 hours.

    Cases like this often spread across accounts; this one has not, so far.

  3. automatic

    Checked what the case's keys can reach: ‹prod-customer-exports› is readable.

    Checked before anything is read, so you know what is at risk.

  4. investigating

    Two networks: AS64501 (‹203.0.113.45›) and AS64509 (‹198.51.100.23›).

    Neither network appears in your last 30 days.

  5. investigating

    Tied every call to one tool fingerprint.

    The same tool signature and machine-pace timing on 212 calls.

  6. investigating

    Spotted ‹ci-deploy-b0t›, a fake copy of ‹ci-deploy-bot›.

    One character differs; easy to miss in a list.

Everything the agent did (9)

Your biggest risks

1Identity

Your CI login ‹ci-deploy-bot› uses a 412-day-old key that can create new users.

CriticalAn old CI key that can create new usersHigh confidence

Fix Move CI to the OIDC role ‹ci-deploy-oidc› and delete the key.

3 findings behind it

2Data

Customer data in ‹prod-customer-exports› can be read by 2 roles nobody uses.

HighCustomer data readable by unused rolesHigh confidence

Fix Remove the two unused roles from the bucket policy.

2 findings behind it

3Clusters

Cluster ‹prod-eu› can be reached from anywhere on the internet.

HighCluster control is open to the internetHigh confidence

Fix Restrict the endpoint to your office and CI ranges, or make it private.

1 finding behind it

2 more risks

87 open issues from the last scheduled scan, 8 critical

From the scan at 06:04 UTC: 8 critical, 31 high, grouped by rule.

8 critical and high open, down from 10 over 30 runs
  1. CriticalAccess keys minted across users in a burst13
  2. CriticalRoot account used12
  3. CriticalDefault policy version changed on an attached policy by a non-deployer12
  4. CriticalAMI shared publicly12
  5. CriticalAdministrator-equivalent AWS-managed policy on a service principal12

Show every finding

What Firekeeper costs

$363.08 a month, estimated

$344.45 for the install at list price, as the agent reports it until a full sweep writes the inventory.

$18.63 a month for the models: the last 7 days ($4.29) averaged over a month.

Models $3.78 of $15.00 today (25%)

Models $3.78 of $30.00 while a case is active (13%)

Every line on Footprint

Make Firekeeper better

Turn these on in AWS so Firekeeper sees more. It reads only what its read role already reads, and changes nothing here.

  1. OffAn organisation trail

    Every account's management events in one trail, so a key that moves into a new account is still seen and a stopped member trail is noticed.

    No charge for the first copy of management events; $2.00 per 100,000 events for a further copy.

    How to turn it on

    In the management account, create a CloudTrail trail for the organisation, all regions.

  2. OffVPC flow logs

    Which addresses your workloads talked to, so data leaving the network and a beacon to an unknown host are seen.

    From $0.50 per GB into CloudWatch Logs, or less delivered to S3.

    How to turn it on

    Create a flow log on each VPC that runs workloads, to S3 or CloudWatch Logs.

  3. Partly onCloudTrail data events on S3 and Lambda

    Object reads and writes and function invocations, so exfiltration from a bucket and use of a function are evidence, not inference.

    $0.10 per 100,000 data events; scope it to sensitive buckets to bound it.

    How to turn it on

    Add data event selectors to your trail for the buckets and functions that hold what matters.

  4. Partly onEKS audit logs on every cluster

    Who did what inside each cluster, so a pod that borrows a role is tied to the workload and the person behind it.

    $0.50 per GB ingested into CloudWatch Logs, plus storage; busy clusters write several GB a month.

    How to turn it on

    Turn on the audit log type in each cluster's logging configuration.

  5. Partly onBedrock model access per role

    The agents: triage within seconds, investigation of active cases, the checked narrative and the chat. Without it Firekeeper runs on fixed rules only.

    No charge to enable; calls are billed per token at the model's list price, held under the agents' daily ceilings.

    How to turn it on

    Request access to the pinned models in the Bedrock console of the hub's region.

  6. Not read yetGuardDuty runtime monitoring, as a witness

    A second, independent view of process and network activity on nodes and containers, which Firekeeper cites beside its own.

    $1.50 per vCPU a month for the first 500 vCPUs monitored, less beyond.

    How to turn it on

    Turn on Runtime Monitoring in GuardDuty for EKS, ECS and EC2 in each region you use.

  7. Not read yetThe recon rule

    Read-heavy enumeration (listing roles, keys and buckets at a pace no person keeps) reaches the event lane as it happens, not at the next run.

    No charge for rules on AWS service events; $1.00 per million events sent across accounts.

    How to turn it on

    Deploy the member template's recon rule in each member account and region.

  8. Not read yetThe cost allocation tag

    What the install was actually billed, beside its list-price estimate on Footprint.

    No charge.

    How to turn it on

    Activate the firekeeper cost allocation tag in the Billing console of the management account.