Skip to content

Defensive Works

Blog

Defensive Works

Blog
Blog
- Detection Engineering with CloudTrail Lake at Scale
AWS
AWS
- General
  General
  - CDK Bootstrapping at scale
- Identity & Access Management
  Identity & Access Management
  - AWS Cross Account Access at Scale
- Logging & Monitoring
  Logging & Monitoring
  - Mapping the AWS Attack Surface
  - CloudTrail Lake Detections
- Incident Response
  Incident Response
  - Security Group Change & Response
Misc
Misc

Blog

Writing about detection engineering, cloud security automation, and building defensive infrastructure at scale.

2026

Detection Engineering with CloudTrail Lake at Scale — March 2026
Why EventBridge pattern matching isn't enough, and how to build a detection pipeline with CloudTrail Lake SQL queries across 300+ accounts.