AWS Incident Detection and Response
Investigate and Contain Attacks in AWS
Take a completely unknown AWS account, pull the right logs, and reconstruct exactly what an attacker did, from first access to business impact. Real CloudTrail, VPC Flow Logs, GuardDuty findings, and live query results included.
What you'll be able to do
Course Syllabus
Every module and every lesson. Open a module to see its lessons.
Download the full syllabus (PDF)
Phase 1: Foundations
What AWS Incident Detection and Response teaches: take an unknown AWS account, pull the right logs, and reconstruct an intrusion from first access to impact, then contain it.
7 lessonsHide lessons
Where AWS evidence lives, the shared responsibility line for incident response, the Northgate AWS Organization and the vantage point you investigate from, and your first queries against real CloudTrail.
11 lessonsHide lessons
- AWS1.1 Shared Responsibility for Incident Response
- AWS1.2 The AWS Organization and Your Vantage Point
- AWS1.3 CloudTrail, the Spine
- AWS1.4 GuardDuty and the Detectors
- AWS1.5 The Supporting Sources
- AWS1.6 The Analysis Surface
- AWS1.7 Reading a CloudTrail Record
- AWS1.8 Your First Queries
- AWS1.9 The Guided Walkthrough
- AWS1.10 Module Summary
- Check My Knowledge
Phase 2: The AWS Analysis Surface
What each AWS evidence source records, what it silently misses, how long it lasts, and which investigative question it answers.
11 lessonsHide lessons
The SQL-over-CloudTrail workflow the rest of the course runs on: filtering millions of events to the few that matter, reaching into nested records, summarizing behavior, sequencing a timeline, and pivoting from one...
10 lessonsHide lessons
- AWS3.1 Asking the First Question
- AWS3.2 Narrowing the Field
- AWS3.3 Reading What CloudTrail Buries
- AWS3.4 From a List to a Pattern
- AWS3.5 Putting Events on a Clock
- AWS3.6 Giving an Event Its Context
- AWS3.7 Building the Query You Don't Have Yet
- AWS3.8 Following the Thread
- AWS3.9 Module Summary
- Check My Knowledge
Phase 3: Identity and Access
Why identity is the perimeter in AWS, and how to read it.
10 lessonsHide lessons
- AWS4.1 Identity Is the Perimeter
- AWS4.2 The Five Faces of a Principal
- AWS4.3 Users and Access Keys
- AWS4.4 Roles and the Assume-Role Model
- AWS4.5 Reading the Session
- AWS4.6 Federation and the Identity with No Name
- AWS4.7 Permission Is the Payload
- AWS4.8 Mapping the Identity Attack Surface
- AWS4.9 Module Summary
- Check My Knowledge
Turning identity reading into detection. The signals that betray a stolen credential being used by the wrong hands, source and geography, console logins and MFA gaps, reconnaissance bursts, anomalous role assumption...
9 lessonsHide lessons
Phase 4: Persistence and Data
Detecting what an attacker does with a foothold: widening limited access into broad control through the IAM permission system, and wiring in the backdoors that survive the loss of the original credential.
10 lessonsHide lessons
- AWS6.1 The Escalation Problem
- AWS6.2 Rewriting Permissions: Policy Version Abuse
- AWS6.3 The PassRole Path
- AWS6.4 Manufacturing a New Identity
- AWS6.5 The Persistence Problem
- AWS6.6 Event-Driven Backdoors: Lambda and EventBridge
- AWS6.7 Persistence Beyond the Foothold
- AWS6.8 Scoping and Eradicating the Foothold
- AWS6.9 Module Summary
- Check My Knowledge
Detecting the objective of most cloud intrusions: the theft, exposure, and destruction of data in S3.
10 lessonsHide lessons
- AWS7.1 The Data Exfiltration Problem
- AWS7.2 The S3 Logging Layers
- AWS7.3 Discovery: Finding the Data
- AWS7.4 The Exfiltration
- AWS7.5 Scoping the Theft
- AWS7.6 Public Exposure: When the Bucket Is the Door
- AWS7.7 Destruction and Ransom
- AWS7.8 Scoping the Data Incident
- AWS7.9 Module Summary
- Check My Knowledge
Phase 5: Compute and Evasion
The third way into a cloud account: a compromised machine whose role credentials the attacker steals through the instance metadata service.
9 lessonsHide lessons
- AWS8.1 The Compute Compromise Problem
- AWS8.2 The Instance Metadata Service
- AWS8.3 Detecting Stolen Instance Credentials
- AWS8.4 Using Instance Credentials
- AWS8.5 Cryptojacking
- AWS8.6 The Network Lens: VPC Flow Logs
- AWS8.7 Scoping and Eradicating the Compute Compromise
- AWS8.8 Module Summary
- Check My Knowledge
When the attacker's goal shifts from using the account to hiding in it.
9 lessonsHide lessons
Phase 6: Response and Capstone
The AWS incident response process, from triage to a closed incident.
9 lessonsHide lessons
- AWS10.1 The Cloud IR Problem
- AWS10.2 Triaging the Incident
- AWS10.3 Containing Compromised Identities
- AWS10.4 Isolating Compromised Resources
- AWS10.5 Preserving Evidence Before Eradication
- AWS10.6 Org-Level Response and Recovery
- AWS10.7 The Containment Runbook
- AWS10.8 Module Summary
- Check My Knowledge
One chained AWS incident, investigated end to end.
Phase 0: Course Resources
Athena queries by investigation area, each with the console path, the fields that carry the decision, and what the answer does not establish.
Seven procedures an AWS responder repeats: triaging a finding, scoping a leaked credential, following an identity chain, establishing what data left, and preserving evidence before eradication.
Building an AWS account that produces the evidence this course investigates, with the cost guardrails in place before anything is switched on.
Six worked AWS investigations against the course corpus, each ending in a written finding with its confidence stated and its gaps named.
Seven response playbooks keyed to what actually fires in AWS, each with a pre-flight, a sequence, escalation tiers and the false positives that live in that domain.
Where to practice AWS investigation and use it at work: query drills against the course corpus, your own account, the detection library, and the reference pages worth keeping open.
AWS service documentation, security guidance, frameworks, and threat-intelligence sources used throughout the AWS Incident Detection and Response course.
Course Completion
AWS Incident Detection and Response end-of-course exam: a simulation-based assessment testing your ability to triage, investigate, and respond to an AWS intrusion you have not seen before, using the evidence and the...
1 lessonsHide lessons
Course overview
AWS Incident Detection and Response teaches you to investigate and respond to attacks in an AWS environment. In AWS there is no disk to image and no packet to capture: almost every action is an API call, and the evidence is the record of those calls in CloudTrail, GuardDuty, VPC Flow Logs, and AWS Config. You learn to read that evidence, query it at scale, and reconstruct an intrusion as a timeline you can defend.
Every module investigates the same fictional company, Northgate Engineering, across its multi-account AWS Organization. You follow one attack chain through the course the way an attacker moves through an environment: identity first, then privilege escalation and persistence, then data and compute, then evasion, and finally the full response. The course runs against a prepared dataset with real query output on the page, so you can practice the entire method without an AWS account, and the AWS Query Lab gives you a free-run space to test your own queries against the same dataset.
How this course works
An AWS investigation is bounded by what the account was configured to log before anything happened. This course runs the same loop for every attack path it covers.
1. Establish what this account records. CloudTrail coverage, data events, VPC flow logs and GuardDuty are each a decision somebody made or did not make. That decision is your evidence ceiling.
2. Query at scale, not by hand. A busy account produces more CloudTrail than a console will show you. Learning to query the evidence is what makes the rest of the course possible.
3. Follow the identity, because everything is one. Users, roles, instance profiles and assumed sessions. Nearly every AWS attack path is an identity moving somewhere it should not.
4. Separate what was reached from what was taken. S3 access patterns and API calls tell you different things, and conflating them is how exfiltration figures get overstated.
5. Contain without destroying the evidence. Revoking a session, detaching a policy and terminating an instance have very different consequences for the investigation still running.
The course closes on a full-chain cloud incident worked end to end.
What this course assumes
No minimum experience and no prerequisite course. IAM, the log sources and the AWS service model are explained where they first matter, and the course does not assume you administer AWS.
What makes it go faster: an AWS account you can read CloudTrail in. Not required, because every query in the course runs against the AWS Query Lab, which holds a real corpus with known answers.
What this course does not cover: AWS administration, cloud architecture and Azure or GCP. This is detection and incident response inside AWS.
Who this course is for
Anyone who wants to learn AWS detection and incident response. No minimum experience required. Every concept is explained at first use, and experienced cybersecurity professionals can move quickly through what they already know using the module structure.
What you'll learn
Key course takeaways
Things you need to know
What are the prerequisites?
None. The course teaches AWS detection and response from first principles. A working knowledge of security operations helps you move faster, and familiarity with IAM or SQL is useful, but neither is required. Every service, field, and query is explained at first use.
What tools does this course use?
SQL over CloudTrail for investigation, the same approach you would run in Amazon Athena against a real account. The evidence comes from CloudTrail, GuardDuty, VPC Flow Logs, AWS Config, and S3 access logs. The course uses a built-in query surface so you can run real queries against the prepared evidence with nothing to install.
Do I need an AWS account?
No. Every investigation runs against a prepared dataset with real query output on the page, so the full method works without an account, a credit card, or a single resource of your own. The AWS Query Lab gives you a free-run space to write your own queries against the same dataset whenever you want to test an idea the lesson did not cover.
How will this course benefit your career?
Organizations running on AWS need people who can investigate a compromise in the cloud, determine what an attacker reached, contain them, and produce a defensible report. That skill is in short supply, because most security training stops at architecture and never sits the analyst down in front of the logs. This course builds the investigative capability end to end.
Usage rights and disclaimer
Course materials: Licensed for individual professional development. You may deploy the investigation queries, detection logic, and runbooks in your production environment. You may not redistribute course content or share account credentials.
Fictional environment: All scenarios use Northgate Engineering (NE) and its AWS Organization. Account IDs, resources, and identities are fictional. Any resemblance to real organizations is coincidental.
End of Course Exam
Complete the course, then prove your skills under time pressure. Pass mark: 70. Earn your certificate with CPE credits.
One random scenario per attempt. Certificate issued on pass.