iota part 1 - building a self-hosted CloudTrail detection engine

tl;dr i&rsquo;m building a lightweight detection engine called iota: https://github.com/bilals12/iota . it reads CloudTrail logs from S3, runs Python rules against them, and sends alerts to Slack. these are design notes on the core implementation, before we head for deployment. why build? CloudTrail logs sit in S3, and we need to run detections against them. as a security team, you have 3 options:…