https://matijazezelj.github.io/packets-and-regrets/tags/cloud-security/Recent content in Cloud Security on Packets & RegretsHugoen-USMon, 31 Aug 2026 18:00:00 +0200https://matijazezelj.github.io/packets-and-regrets/posts/i-built-the-cloud-audit-siem-i-kept-wishing-existed/Mon, 31 Aug 2026 18:00:00 +0200https://matijazezelj.github.io/packets-and-regrets/posts/i-built-the-cloud-audit-siem-i-kept-wishing-existed/<p>Cloud audit logs contain some of the best evidence in an incident and some of the least pleasant data to operate.</p> <p>Every provider has a different delivery mechanism, event shape, pagination model, failure mode, and idea of what an actor or target should look like. Getting the logs is only the start. You still need to normalize them without throwing away the original event, detect hostile behavior, notice when collection silently stops, retain enough history to investigate, and prove that the whole thing survives a database failure and a restore.</p>