Topic

Log-Based Threat Hunting

Searching retained platform audit logs for traces that a particular technique or vulnerability was used against an environment.

Current clusters

build1 publisher

CVE-2026-89049 converts a port-forwarding permission into instance-role credentials

AWS fixed an SSRF in SSM Agent 3.3.4851.0. How much the bug actually gave an attacker depends on your IAM layout, and CloudTrail's StartSession records already show who called the vulnerable document.

Publishers:dev.to

Reality

Evidence58
Adoption25
Hype gap+12
Incentives28
Confidence55