AWS Threat Detection and Incident Response

AWS Threat Detection and Incident Response: investigating attacks in AWS from the evidence AWS records, taught with Athena SQL against five weeks of an engineering company's AWS accounts with six real attacks in them.

Module 1 of AWS Threat Detection and Incident Response: how CloudTrail records reach Athena, the CloudTrail table and its columns, selecting and filtering, the identity block, management and data events, time windows, and reads, writes and errors.

Module 2 of AWS Threat Detection and Incident Response: combining conditions, matching text and patterns, extracting values from JSON, arrays and UNNEST, counting and grouping, filtering groups with HAVING, ranking and top-N, and building a timeline.

Module 3 of AWS Threat Detection and Incident Response: IAM users, access keys and the root user; roles and AssumeRole; joining a session to its source; cross-account access; federation and Identity Center sign-in; service-linked roles and service principals; common table expressions; attributing an action to a person.

Module 4 of AWS Threat Detection and Incident Response: how credentials leak, detecting use of a leaked key, console sign-in and MFA evidence, root user activity, reading GuardDuty findings, discovery after access, baselines and first-seen analysis, and scoping a compromised credential.

Module 5 of AWS Threat Detection and Incident Response: escalation paths in IAM, policy versions and inline policies, PassRole through compute services, trust policy changes, new users, keys and login profiles, configuration history with AWS Config, window functions for change sequences, and proving what an identity could do.

Module 6 of AWS Threat Detection and Incident Response: bucket access control and Block Public Access, public exposure and who used it, data events for object access, S3 server access logs, measuring what left, the KMS witness, ransom with customer-provided keys, and scoping a data theft.

Module 7 of AWS Threat Detection and Incident Response: the instance metadata service, instance credentials used elsewhere, VPC Flow Logs, DNS query logs, load balancer logs and SSRF, Lambda abuse, joining network and API evidence, and reconstructing a host's activity.

Module 8 of AWS Threat Detection and Incident Response: stopping and deleting trails, changing what a trail records, disabling GuardDuty, Config and Security Hub, Region and account evasion, anonymized infrastructure, gaps in the record, proving logging was intact, and evasion in a timeline.

Module 9 of AWS Threat Detection and Incident Response: triaging GuardDuty findings, attack sequence findings, Security Hub in both formats, suppression and trusted lists, detections from CloudTrail queries, testing a detection against the sample period, tuning false positives, and writing a detection specification.

Module 10 of AWS Threat Detection and Incident Response: the AWS incident response process and AWS's role in it, triaging and declaring an incident, containing compromised identities and resources, organization-level containment with SCPs and RCPs, preserving evidence, eradication and recovery, and post-incident review.

Athena queries by investigation area, each with the console path, the fields that carry the decision, and what the answer does not establish.

Seven procedures an AWS responder repeats: triaging a finding, scoping a leaked credential, following an identity chain, establishing what data left, and preserving evidence before eradication.

Building an AWS account that produces the evidence this course investigates, with the cost guardrails in place before anything is switched on.

Six queries from the course that ran cleanly and answered wrongly, each taken step by step to the right answer: a Region filter, a writes-only timeline, a role's empty user name, a sign-in's missing error, an anonymous reader and an alert's time.

Seven response playbooks keyed to what actually fires in AWS, each with a pre-flight, a sequence, escalation tiers and the false positives that live in that domain.

Where to practice AWS investigation and use it at work: query drills against the course corpus, your own account, the detection library, and the reference pages worth keeping open.

Every query, field and command from AWS Threat Detection and Incident Response in one place, organized by the task in front of you and linked back to the lesson that explains it.

AWS service documentation, security guidance, frameworks, and threat-intelligence sources used throughout the AWS Threat Detection and Incident Response course.

The AWS Threat Detection and Incident Response project: a readiness assessment of an AWS account, five detections tested and specified to Module 9's standard, and an investigation report on a prepared case none of the modules teaches, written to Module 10's standard. No submission, no grading.

AWS Threat Detection and Incident Response practical exam: twenty tasks, two per teaching module, each answered by writing Athena SQL against Northgate's record and checked on the server.