I've been working on the investigation side of Kultarr recently, and one of the things I've been paying more attention to is how much we can actually learn from a single AWS event.
I was looking at a real CloudTrail event where the AWS root account was used to execute ListAccessKeys.
Nothing particularly complicated about the API call itself. CloudTrail recorded the operation, the AWS principal, the source IP, the timestamp, and other details about the request.
But I started thinking about something.
We know the request was made using the root identity. Do we actually know who was sitting behind the keyboard?
Not necessarily.
CloudTrail can provide useful evidence about the credentials and session involved, but that doesn't automatically identify the human responsible for the activity. And depending on the environment, there may be additional information needed to understand what really happened.
That's something I've been trying to make clearer in Kultarr.
Instead of only displaying the event, the investigation view brings together the available identity details, session information, and supporting CloudTrail evidence.
I'm also working on making it clear when something hasn't been established yet.
For example, in this case, the AWS principal is known, but the human behind the activity hasn't been independently identified. The current AWS state hasn't been verified either.
I think those details matter, especially when someone is trying to decide whether an event needs further investigation.
Another thing I'm currently improving is risk scoring.
In the screenshots, you'll notice a Critical severity label alongside a 9/100 contextual risk score from an earlier scoring model.
That difference deserves an explanation. A contextual score and an event's severity aren't necessarily measuring the same thing, but if the interface doesn't explain that clearly, it can be confusing.
I'm reviewing this across Kultarr rather than just changing the number to make it look more serious.
There's still work to do, but the platform is getting closer to launch.
One thing I've learned while building this is that having more security data doesn't automatically make an investigation easier. The difficult part is understanding what the data supports and where the gaps are.
That's something I want to keep improving.
The screenshots are from a real AWS CloudTrail event. Identifying details have been anonymized for demonstration.
If you've worked with CloudTrail investigations, I'd be interested to hear how you approach attributing root-account activity to an actual person.
aws #cloudsecurity #cybersecurity #devops
Top comments (0)