HACKING PROJECT · cloud · Advanced
Cloud SIEM Log Aggregator
Build a cloud-native, multi-account SIEM pipeline that centralizes, normalizes, and detects threats across cloud telemetry.
Cloud environments emit vast, fragmented telemetry — VPC flow logs, CloudTrail/audit logs, IAM events, container logs — across accounts and providers, and without centralization threats hide in the gaps. Teams struggle to normalize, retain, and query this data affordably, and commercial SIEM licensing is prohibitive at cloud scale. Detections are only as good as the log pipeline feeding them.
**What you'll build**
Build a cloud-native SIEM log-aggregation pipeline that centrally ingests multi-account/multi-cloud logs, normalizes them to a common schema (OCSF/ECS), enriches and indexes them for search, and applies detection rules (Sigma) to generate alerts. Include retention tiering, dashboards, and correlation across identity, network, and workload telemetry.
**Objective** — Build a cloud-native, multi-account SIEM pipeline that centralizes, normalizes, and detects threats across cloud telemetry.
**Expected outcome** — A working log-aggregation SIEM ingesting multi-cloud logs into a normalized schema with Sigma-based detections, dashboards, and retention tiering.
**Difficulty** — Advanced — requires multi-cloud log engineering, schema normalization, scalable indexing, and detection-rule authoring.
**Primary category** — SOC; Secondary = Cloud Security, Detection Engineering, Data Engineering
**Security domains** — Primary = Cloud Security; Secondary = Blue Team, DevSecOps, Detection Engineering, Incident Response
**Technical focus** — Log aggregation, schema normalization (OCSF/ECS), multi-account/multi-cloud ingestion, detection rules (Sigma), CloudTrail/VPC flow analysis, IAM event monitoring, retention tiering, dashboarding, alert correlation
**Core technologies** — Languages: Python, Go; Frameworks/Libraries: Vector/Fluent Bit, Logstash, Sigma, OCSF schema; Security Tools: Wazuh, Elastic Security, OpenSearch, Sigma/sigmac; Cloud/Infra: AWS (CloudTrail, VPC Flow, Kinesis, S3), Azure/GCP logs, Kubernetes, Kafka; AI/Data: anomaly detection, aggregation analytics; Databases: OpenSearch/Elasticsearch, S3 (cold tier), ClickHouse
**Where it's valued** — Cloud-native companies, SaaS, finance, MSSPs/MDR, any multi-cloud enterprise, healthcare
**Careers it builds toward** — Cloud Security Engineer, SOC / Detection Engineer, Security Data Engineer, DevSecOps Engineer, SIEM Engineer
**Framework alignment**
• MITRE ATT&CK: detects Cloud tactics — Valid Accounts (T1078.004 cloud), Unused/Unsupported Cloud Regions (T1535), Data from Cloud Storage (T1530), Account Manipulation (T1098), Exfiltration Over Web Service (T1567); ATT&CK for Cloud matrix
• NIST CSF 2.0: Detect (DE.CM, DE.AE), Identify (ID.AM), Respond (RS.AN), Protect (PR.PS); Govern (GV.OC) for logging policy
• OWASP: API-related detections where cloud APIs are abused; A09 Security Logging & Monitoring Failures
• CIS Controls v8: 8 Audit Log Management, 13 Network Monitoring & Defense, 6 Access Control Management