iota part 1 - building a self-hosted CloudTrail detection engine

This page cannot be shown here. You can still read it on the original site — the toolbar below keeps your place in the directory.

tl;dr i’m building a lightweight detection engine called iota: https://github.com/bilals12/iota . it reads CloudTrail logs from S3, runs Python rules against them, and sends alerts to Slack. these are design notes on the core implementation, before we head for deployment. why build? CloudTrail logs sit in S3, and we need to run detections against them. as a security team, you have 3 options:…

Read on /posts/iota-1/ ↗