Cloud Incident ResponseTraining & Resources
Trainings and free/open-source references, grouped by focus area. Options, not endorsements - confirm current syllabus, price, and links with each provider. Add more via a pull request.
Cloud forensics & incident response
Acquiring, preserving, and analysing cloud evidence, and running the investigation end to end.
Training
SANS FOR509
Enterprise Cloud Forensics & Incident Response - the flagship multi-cloud DFIR course.
TrainingInvictus Cloud Labs
Self-paced hands-on cloud IR labs - free starter plan, affordable premium (cheap option).
TrainingInvictus Cloud IR courses
Expert-led AWS and Microsoft cloud IR courses (from ~EUR 1,650); team discounts.
TrainingDFIR Diva - Cloud DFIR
Curated free and affordable cloud forensics/IR training.
ToolCloudFox
Read-only situational awareness; scope blast radius and attack paths.
ToolCloud Console Cartographer
Maps CloudTrail groupings back to console actions (Permiso).
ToolMicrosoft-Extractor-Suite
Free tooling to collect M365/Azure/Entra logs for IR (Invictus).
ToolRansomWhen
Detects S3 KMS-lock ransomware exposure and occurrences (Permiso).
ReferenceTrailDiscover
CloudTrail events with security significance and incident references.
Referencebreaches.cloud
Write-ups of publicly known cloud breaches.
ReferenceAWS Security IR Guide
Official AWS incident response whitepaper.
ReferenceMicrosoft IR guidance
Entra/M365/Azure incident response playbooks.
Detection & threat hunting
Finding malicious activity in cloud telemetry and building detections around adversary behaviour.
Training
SANS SEC541
Cloud Security Threat Detection - hands-on detection across AWS, Azure, and M365.
TrainingInvictus Cloud Labs
Affordable self-paced labs to practise cloud detection and hunting.
ToolProwler
Read-only checks mapped to CIS/NIST/ATT&CK; confirms logging posture.
ToolCloudGrappler
Queries cloud logs for threat-actor detections (Permiso).
ToolSkyScalpel
Detects obfuscation in AWS IAM policies (Permiso).
ToolYetiHunter
Hunts Snowflake environments for compromise (Permiso).
ReferenceMITRE ATT&CK Cloud
Authoritative technique set for IaaS, SaaS, IdP, Office Suite.
ReferenceDatadog Security Labs
Cloud detection engineering and threat research.
ReferenceGCP Threat Horizons
Cloud-specific threat telemetry from Google.
Architecture & infrastructure security
Hardening cloud environments so incidents are less likely and better logged - the posture that makes IR possible.
Training
SANS SEC510
Cloud Security Engineering and Controls - attack-driven defences across AWS, Azure, GCP.
TrainingProvider security paths
Free AWS/Microsoft/Google security learning tracks.
ToolProwler
Posture and compliance scanning across the major clouds.
ToolScoutSuite
Multi-cloud auditing with an offline HTML posture report.
ToolCartography
Graphs cloud assets and relationships for reachability analysis.
Toolbucket-shield
Hardening helper for S3 bucket exposure (Permiso).
ReferenceCIS Benchmarks
Consensus hardening baselines for AWS, Azure, GCP, Kubernetes.
ReferenceAWS Well-Architected Security
AWS security design guidance.
ReferenceAzure Well-Architected Security
Microsoft security design guidance.
ReferenceGCP security foundations
Google Cloud security architecture blueprint.
Communities & conferences
Free talks, encyclopedic references, and community research - much of the best cloud tradecraft lives here.
Community
Cloud Village (DEF CON)
Talks, workshops, and CTFs on offensive and defensive cloud security.
Communityfwd:cloudsec
Cloud-agnostic cloud security conference; free talk recordings.
CommunityHacking the Cloud
Encyclopedia of offensive and defensive cloud techniques (Nick Frichette).
CommunityPermiso P0 Labs
Cloud threat research and the open-source tools used across this page.
Communitytl;dr sec
Weekly newsletter with strong cloud security coverage.
Contributors
Erblind Morina
Principal Incident Response Consultant / Cloud IR Lead
IBM X-Force
Main contributorGiacomo Casoni
Senior Incident Response Consultant
IBM X-Force
Want to be part of it?
Anyone can join. Open a pull request that fixes a fact, adds a log source or tool, contributes a talk or resource, or improves a page - and add yourself to the contributors. New maintainers are welcome; if you want to help curate a section (a provider, detection content, or training), say so in your PR or open an issue on GitHub.