You’ll learn how attackers abuse identity, permissions, and cloud-native APIs, and how those actions appear inside AWS telemetry. From CloudTrail to VPC Flow Logs, from GuardDuty findings to raw log investigations, you’ll practice reading signals the way a real SOC analyst does.
You’ll learn:
How to investigate suspicious activity in AWS step by step
How to connect weak signals across logs
How to move from alert-driven SOC work to proactive threat hunting
How to explain findings clearly during incidents and escalations
Who This Course Is For
This course is designed for:
SOC Analysts who want to move into cloud-focused roles
Junior–Mid Security Analysts struggling to understand AWS logs and alerts
Blue Teamers who want real-world cloud threat hunting skills
Cloud Engineers who want to understand how AWS is attacked and defended
Security students preparing for SOC, cloud security, or detection roles
Pre-Requisites (What You Should Know Before Starting)
You don’t need to be an AWS expert but some basics will help.
Recommended (not strict requirements):
Basic understanding of AWS services (EC2, IAM, S3 at a high level)
Familiarity with security concepts (authentication, permissions, logging)
Basic SOC knowledge (alerts, incidents, logs even from on-prem environments)
You do not need:
Advanced scripting
Prior threat hunting experience
Deep cloud architecture knowledge
Everything AWS-specific is explained from a security analyst’s perspective, not a cloud engineer’s.
