Cloud IR Playbooks & SIEM Detection Engineering
18 custom KQL detection rules mapped to MITRE ATT&CK for Cloud - reducing MTTD by 65% and automating 40% of alert responses via SOAR.
A regulated financial institution on AWS lacked cloud-native incident response capability. AWS and Azure telemetry was not feeding into any SIEM, detection relied on default GuardDuty rules not tuned to the specific threat model, and there were no documented response procedures for cloud attack scenarios. Mean time to detect for cloud incidents was measured in days rather than hours, and responders had no playbooks to guide containment and investigation.
I started with the threat model - identifying the most likely attack paths for a financial institution on AWS and mapping them to MITRE ATT&CK for Cloud (IaaS). I built custom KQL detection rules in Microsoft Sentinel for each high-priority technique: IAM credential compromise, S3 data exfiltration, EC2 cryptomining, GuardDuty/CloudTrail disablement, federated session hijacking, and ransomware indicators. For each detection, I built a corresponding SOAR automation in Logic Apps for deterministic response actions. I also developed four cloud IR playbooks aligned to NIST SP 800-61 Rev 3, and a full Cloud IR Plan documenting the IRT structure, six-phase lifecycle with formal decision gates, and regulatory notification obligations.