CSPM2CloudTrail: Extending CSPM Tools with Threat Hunting Context
Rodrigo Montoro introduces CSPM2CloudTrail, bridging static Cloud Security Posture Management misconfigurations with dynamic AWS CloudTrail event analysis.
Summary
The Limitations of Static CSPM and Noisy CloudTrail Logs
While Cloud Security Posture Management (CSPM) tools flag static misconfigurations, AWS CloudTrail logs thousands of API calls per minute without contextual prioritization.
Introducing CSPM2CloudTrail for Contextual Threat Hunting
Rodrigo Montoro presents CSPM2CloudTrail, an open-source tool that enriches static posture findings with dynamic CloudTrail API telemetry.
Detecting Active Exploitation of Misconfigured Assets
By correlating high-risk configurations (e.g. public security groups) with specific CloudTrail event histories, defenders identify whether assets were actively probed or exploited.
Automating Cloud Incident Response Triage
Montoro demonstrates how SOC analysts can accelerate triage workflows by automatically isolating compromised IAM credentials and generating remediation timelines.
Related talks
Blue Team Village·17 min
Saurabh Chaudhary
Saurabh Chaudhary demonstrates crafting high-performance, modular YARA rules to detect complex malware variants and streamline threat hunting.
Blue Team Village·50 min
Project Obsidian
Project Obsidian details hunting for malicious scheduled tasks, cron jobs, and stealthy persistence mechanisms across enterprise endpoints.
Village Interviews·9 min
Coordinators outline detection engineering workshops, defense operations, and Project WARPATH at Blue Team Village.