Kafayat FaniranCloud Security • IAM • Founder • AuthorContact
Menu

CASE STUDY 04 • OPEN-SOURCE DETECTION ENGINEERING

Cloud Security Detection as Code

A reusable multi-cloud detection catalogue for Azure, AWS and Google Cloud, built around provider-native telemetry, MITRE ATT&CK mapping, testable hypotheses and explicit evidence states.

View open-source repository ↗

PROBLEM

A query is not automatically a detection.

Useful detection engineering requires more than matching an event. Analysts need to understand the threat hypothesis, required telemetry, severity, expected false positives, triage path, response guidance and how the rule was tested.

No rule is labelled validated simply because the query parses. The repository distinguishes implemented, tested and validated states.

DETECTION STANDARD

Give every rule enough context for another analyst to review it.

HYPOTHESISWhat behaviour matters?

Define the security behaviour or control change the rule is intended to surface.

TELEMETRYWhat evidence is required?

Identify the provider-native logs and fields needed for meaningful evaluation.

ANALYSISHow should it be triaged?

Document false positives, contextual questions and investigation steps.

RESPONSEWhat follows a true positive?

Provide response guidance without pretending every match requires the same action.

V1 CATALOGUE

Six initial detections across three cloud ecosystems.

  • AZ-001: repeated failed Microsoft Entra sign-ins.
  • AZ-002: privileged Entra role assignment.
  • AWS-001: successful AWS console login without MFA.
  • AWS-002: AWS IAM permission or trust-policy change.
  • GCP-001: Google Cloud IAM policy change.
  • GCP-002: Google Cloud service-account key creation.

The first portable Sigma translation is included where the source event can be represented without hiding important provider context.

DETECTION QUALITY

Use CI to reject incomplete catalogue entries.

A Python validator and GitHub Actions workflow check the detection metadata contract, unique IDs, supported platforms and states, MITRE technique formatting, required query files, false-positive notes, safe test scenarios, triage guidance, response guidance, limitations and Sigma YAML parsing.

The final catalogue quality workflow is green, so the repository standard is enforced by code rather than documentation alone.

VALIDATION

Promote rules only when controlled telemetry supports the claim.

The first validation backlog covers repeated Entra sign-ins, AWS console authentication without MFA and GCP service-account key creation. Controlled activity, expected events, query results, analyst context and sanitised evidence will be reconciled before any rule is promoted beyond implemented status.

OPEN-SOURCE DIRECTION

Build something useful enough for peer review and contribution.

The repository includes an MIT licence, contribution guidance, code of conduct, security policy, machine-readable schema and contribution backlog. The longer-term objective is external use, issues, pull requests and practitioner feedback, not simply increasing the number of detections.