Cloud Detection & Response

This roadmap is about detecting and responding to attacks in AWS, Azure and Google Cloud, where identity and API activity matter more than network packets. Basic cloud knowledge and SOC fundamentals are recommended.

• Know the main audit log of each cloud provider
• Have a practice account with logging enabled
• Plan your study time

• CyberA4U Academy — courses

Each cloud has its own logs: control-plane audit logs (CloudTrail, Azure Activity Log, Cloud Audit Logs), identity sign-in logs, network flow logs and service-specific logs. Knowing what each records is the base of cloud detection.

• List control-plane, identity, network and data-access logs per provider
• Know which are enabled by default
• Plan centralized collection

Tools & tech: Cloud D&R

• AWS CloudTrail User Guide
• Azure Monitor — Activity log

In the cloud, stolen credentials are the most common entry point. Detections focus on unusual sign-ins, new keys, privilege changes and impossible travel.

• Detect risky sign-ins and MFA changes
• Alert on new access keys and role assignments
• Correlate identity events with resource activity

Tools & tech: Cloud D&R

• What is Microsoft Entra ID Protection?

Data theft in the cloud often looks like normal API calls: large downloads, new sharing links, snapshot copies or bucket policy changes.

• Identify API actions that can expose data
• Detect unusual volume and new external principals
• Use managed detections such as GuardDuty findings

Tools & tech: Cloud D&R

• Amazon GuardDuty — Finding types

Compromised VMs, containers and functions show up as unexpected processes, outbound connections, crypto-mining or metadata service abuse.

• Recognize signs of compromised compute
• Use runtime and flow-log signals
• Know which managed detections cover compute

Tools & tech: Cloud D&R

• Amazon GuardDuty — Finding types

Automation makes cloud response fast and consistent — for example, disabling a key or isolating an instance when a high-confidence alert fires.

• Choose which responses are safe to automate
• Build a simple playbook
• Keep a human approval step for risky actions

Tools & tech: Cloud D&R

• Microsoft Sentinel — Automation

Cloud containment uses identity and configuration: revoke sessions, deactivate keys, restrict security groups, and snapshot for evidence before changing anything.

• Contain compromised identities
• Isolate compute without destroying evidence
• Prevent re-entry

Tools & tech: Cloud D&R

• AWS Security Incident Response Guide

You don't own the hardware in the cloud, so forensics relies on logs, snapshots and provider APIs. Short log retention and ephemeral resources are common obstacles.

• Understand what evidence is available in the cloud
• Preserve snapshots and logs early
• Plan retention before incidents

Tools & tech: Cloud D&R

• NIST IR 8006 — NIST Cloud Computing Forensic Science Challenges

Organizations using several clouds get different log formats, identity systems and tools. A common schema and central SIEM make detection consistent.

• Normalize cloud logs to a common schema
• Map equivalent events across providers
• Avoid gaps between tools

Tools & tech: Cloud D&R

• Open Cybersecurity Schema Framework (OCSF)

A tabletop exercise tests whether the team knows who owns each cloud account, where logs are, and how to contain an incident quickly.

• Run a cloud-focused scenario
• Test access to logs and consoles during the exercise
• Record gaps and owners

Tools & tech: Cloud D&R

• CISA Tabletop Exercise Packages

Detection-as-code stores detection rules in version control, reviews and tests them like software, and deploys them automatically.

• Write detections in a portable format such as Sigma
• Review and test rules before deployment
• Track changes over time

Tools & tech: Cloud D&R

• Sigma — Rules basics

Measure how many cloud accounts send logs, how many important API actions have detections, and how quickly alerts are triaged and contained.

• Measure logging coverage per account
• Measure detection coverage of key actions
• Track time to triage and contain

Tools & tech: Cloud D&R

Walk through a realistic incident — a leaked key used to create resources and read data — from first alert to lessons learned.

• Reconstruct the timeline from audit logs
• Identify the containment and recovery steps
• Write lessons learned

Tools & tech: Cloud D&R

• AWS Security Incident Response Guide

Check that you can detect, investigate and contain an incident in at least one cloud provider using its logs and tools.

• Find the right logs quickly
• Write and test a detection
• Contain without losing evidence

• CyberA4U CTF Arena — practice challenges

You can now handle detection and response in the cloud. Continue with Detection Engineering or SIEM Engineering, or deepen one provider's security certification.

• Keep your detections in Git
• Choose your next roadmap
• Share one detection you built

• CyberA4U CTF Arena — practice challenges