Category: Cyber Threat

A practitioner’s guide to the minimum viable cloud log set: CloudTrail, identity, DNS at tier one. Coverage matrix across AWS, Azure, GCP plus cost trade-offs.

A five-stage detection engineering framework — hypothesis, data inventory, logic, validation, metrics — with an AWS GuardDuty worked example, YAML rule template, and a failure-analysis playbook for noisy or silent detections.

Precision, recall, F1, alert-fatigue math, ATT&CK saturation and a working scorecard template. The metrics every detection engineer must track — with formulas and a downloadable CSV.

Living off the cloud | LotC | CloudTrail | VPC Flow | fusion | malware-free

Insider threat | UEBA | identity | peer baseline | VPC Flow Logs | behavioral