Building detection coverage for Lumen Labs' multi-cloud estate: an attack chain caught at every layer — an admin credential stopping the trail, a developer credential hopping through three roles to admin, a CI key suddenly used from a residential IP and bulk reads from a data bucket; the cloud detection stack of eight layers from control-plane logs, identity signals, network and flow, workload and runtime and data-plane access up to managed detections, custom detections and response hooks, built on one organisation-wide trail across forty-plus accounts; and detection as code — a Sigma rule for a stopped CloudTrail mapped to ATT&CK — wired to a guardrailed response hook.

CY-MID-101Mid Level · Cloud Detection Engineering

Cloud Detection Engineering — The Cloud Detection Stack

A hands-on mid-level course that builds detections specifically for cloud control planes and cloud-native services - not a generic detection pipeline, not incident response. Work the cloud detection stack - eight layers from control-plane logs to guardrailed automated response: Control-Plane Logs, Identity Signals, Network & Flow, Workload & Runtime, Data-Plane Access, Managed Detections, Custom Detections, and Response Hooks - collecting the right telemetry, tuning and verifying managed detections, writing detection-as-code mapped to ATT&CK Cloud, and wiring safe automated containment, with real AWS/Azure/GCP CLI and KQL/SQL-style query work. Four hands-on activities in every lesson.

15 hours8 chapters32 lessons225 activities8 labs

What you'll learn

Build organization-wide, integrity-checked control-plane logging across every account and region.
Detect identity abuse through role-assumption chains, credential misuse, and correlated IdP signals.
Detect lateral movement, C2, and exfiltration through flow logs, DNS logging, and egress baselining.
Tune and verify managed detections, write custom detection-as-code mapped to ATT&CK Cloud, and wire guardrailed automated response.

Price:৳8,000