Cloud Detection Engineering Platform

A public-safe cloud detection engineering platform that connects synthetic AWS-style telemetry, detection-as-code, validation harnesses, dashboards, evidence, and response workflows into one portfolio capstone.

What This Project Shows

• Cloud detection engineering with public-safe AWS-style telemetry.
• Detection-as-code artifacts with severity, confidence, ATT&CK mapping, and validation references.
• Positive and negative validation cases for each scenario.
• Analyst-ready evidence mapping and a reusable triage runbook.
• A static dashboard generated from repository artifacts.
• A small verification command that proves the first slice is internally consistent.

Why It Matters

Individual detections are useful, but a stronger security engineering signal is the repeatable platform pattern around them: telemetry assumptions, detection logic, test cases, evidence, runbooks, dashboard state, and public-safe release discipline.

This first slice intentionally stays small. It proves the workflow without claiming production coverage or using real cloud tenant data.

Architecture

synthetic AWS-style events
        |
        v
detection-as-code artifacts
        |
        v
expected alert outputs
        |
        v
validation harness and dashboard data build
        |
        v
static dashboard, evidence map, and analyst runbook

Detection Lifecycle

Step	Artifact
Model the risk	docs/detection-lifecycle.md and scenario notes in each detection
Generate telemetry	data/events/*.jsonl
Write detection logic	detections/*.yml
Validate behavior	data/expected-alerts/*.json and tools/validate-platform.mjs
Package evidence	evidence/evidence-map.json
Guide response	runbooks/cloud-detection-triage.md
Present status	dashboard/index.html and generated dashboard/platform-data.json

Initial Scenarios

Scenario	Detection	Signal
Suspicious IAM access key behavior	detections/iam-access-key-anomaly.yml	Unusual API sequence from documentation-safe source networks
S3 data access and exfiltration path	detections/s3-data-access-anomaly.yml	Bulk object reads and suspicious data access pattern
EKS secret or workload access anomaly	detections/eks-secret-access-anomaly.yml	Secret read behavior from an unexpected workload identity

Key Artifacts

• Detections: detections/
• Synthetic events: data/events/
• Expected alerts: data/expected-alerts/
• Evidence map: evidence/evidence-map.json
• Runbook: runbooks/cloud-detection-triage.md
• Architecture notes: docs/architecture.md
• Public-safe boundary: docs/public-safe-boundary.md
• Dashboard: dashboard/index.html

Verification

Run the full first-slice verification:

npm run verify:all

This checks required files, detection IDs, validation references, expected alert mappings, public-safe documentation, dashboard data generation, and obvious secret-token patterns across public artifacts.

Public-Safe Boundary

This project uses synthetic public-safe telemetry and evidence. It demonstrates cloud detection engineering methods without exposing private tenant, customer, account, credential, ticket, or incident details.

See docs/public-safe-boundary.md.

Role / Certification Alignment

This project maps to domains commonly covered by AWS Security Specialty, CCSP, SC-200, and GCIH. It demonstrates hands-on application of those concepts; it is not a substitute for a formal certification when a role explicitly requires one.

Relationship To Existing Labs

• CloudSec-SOC-Detection-Lab shows AWS-first SOC investigation and evidence handling.
• Datadog-Detection-Engineering-Lab shows monitor-as-code, validation, tuning, and runbooks.
• SaaS-Attack-Chain-Detection-Lab shows identity-to-data attack-chain correlation.

This repository acts as a capstone pattern that combines those ideas into a small platform skeleton.