Cloud Console Cartographer: Tapping Into Mapping

Speakers and goal

Permiso researchers Cam and Daniel introduce Cloud Console Cartographer, an open-source tool to map noisy AWS console-session logs into understandable attacker or user activity.

Cloud logging realities

Cloud logs differ from endpoint telemetry: less control, API-call abstraction, control-plane vs data-plane split, retention limits (e.g., 30/90 days), delays, and query throttling. Forwarding to S3/blob storage helps scale and retention but can drop fields such as CloudTrail's resources section.

Console focus

Console means browser-based AWS/Azure portal use, not CLI. They say attackers do use consoles, sometimes with click-through playbooks or technical limitations.

Defender guidance

Enable non-default logs, forward them to durable storage, monitor ingestion, and test tools before incidents. The talk promises a solution walkthrough and demo of Cartographer for reconstructing what happened inside verbose console sessions.