From the blog
Blue Team
Read practical guides, tutorials, and security research about Blue Team from the Cybr blog.
Browse the archive
More Blue Team articles
Instantly Query AWS with Steampipe Using SQL
How can I find security misconfigurations in my AWS accounts within minutes? How can I do that without spending weeks setting up data pipelines, or…
Read article
Managing cloud permission security at scale [Cheat Sheet]
So you’re using the cloud and things are going great, but after a few months, you start to run across these common issues: Issue 1…
Read article
Incident Response Playbook – EC2 Cryptomining [Cheat Sheet]
You wake up tomorrow to a GuardDuty notification that there might be EC2 cryptomining activity going on in one of your AWS accounts. What’s your…
Read articleAWS CloudTrail Events to Monitor and Alert On
A list of CloudTrail events, grouped by service, that can indicate a security event in your AWS account and are worth considering for alerts.
Read articleAWS Threat Detection: Services and Events to Watch
The AWS-native services for threat detection, and the IAM and configuration changes that can signal a threat actor is in your account.
Read articleAWS Security Monitoring, Logging, and Alerting
How CloudTrail, CloudWatch, EventBridge, and Athena work together for security monitoring in AWS, plus the AWS logging, aggregation, and visualization services.
Read articleHow to Achieve Least Privilege in AWS IAM
Least privilege is easy to say and hard to do. Here are practical steps to get there in AWS, and how IAM Access Analyzer helps you check your policies.
Read article