ResearchGraduate project
Forensic Visibility in AWS
I built a controlled AWS environment to test how well its logs could reconstruct simulated attacker activity. The work involved collecting evidence, checking hashes, and piecing together timelines across multiple logging sources.
I wanted to understand what you can recover from those logs, where the gaps are, and how much changes when you correlate the sources.
- Simulate activityControlled AWS environment
- Collect evidenceCorrelate native log sources
- ReconstructCheck hashes & build timelines
CloudTrail · VPC Flow Logs · GuardDuty · CloudWatch
Research summary
