PROJECT 003 · CLOUD SECURITY

> cat cloudsec-pipeline.md

Extending an on-prem SOC into AWS, without a second SIEM.

A hybrid cloud security project that pipes AWS network telemetry — VPC Flow Logs, by way of CloudWatch — into an existing on-premises Wazuh deployment. Raw flow records are normalized into structured, MITRE-aligned behavioral events before they ever reach the SOC, instead of dumping every packet record into a second, expensive cloud SIEM.

mvp — live telemetry hybrid soc, one siem mitre att&ck aligned no per-gb siem licensing

View Repository Back to Portfolio

cat overview.md

The visibility gap

Most orgs moving workloads into AWS keep running their SOC on-prem — and that split creates a real gap. Cloud resources generate genuinely useful network telemetry, but getting it collected, transported, and analyzed securely and cost-effectively is a different problem than watching on-prem traffic.

Commercial cloud SIEMs (Sentinel, Splunk ES, QRadar, Cortex XSIAM) solve this well — at a licensing and ingestion cost that's hard to justify for a lab, a small team, or anyone learning the space.

Rather than standing up a second SIEM in the cloud, this project extends an existing on-prem Wazuh deployment outward using AWS-native services — giving one SOC visibility into both environments instead of two SOCs that don't talk to each other.

show challenges

The Problem, in Three Parts

Cloud Visibility

AWS workloads generate valuable network telemetry that traditionally stays isolated from on-prem security monitoring.

Cost

Enterprise cloud SIEM platforms bring licensing, ingestion, and storage costs that are hard to justify for a personal lab.

Signal vs. Noise

Forwarding every raw VPC Flow Log into a SIEM inflates storage and makes analyst investigations harder, not easier.

show topology

Pipeline Architecture

Telemetry is normalized into structured security events before it ever leaves AWS — the on-prem SOC receives signal, not raw noise.

path — vpc to soc dashboardclick to expand

6 hops · flow logs → behavioral events · on-prem soc dashboard

show interfaces

Cloud Infrastructure Highlights

Amazon VPC

The core networking foundation the whole pipeline observes — EC2, ALB, NAT Gateway, and other resources all sit inside it.

VPC Flow Logs

Centralized network telemetry at the interface level — every accepted and rejected connection, without touching the host OS.

Amazon CloudWatch

The managed aggregation layer flow logs land in before anything gets processed or forwarded onward.

EC2 Processing Layer

Transforms raw telemetry into structured security events — the step that turns noise into signal.

IAM, Least Privilege

Service permissions scoped tightly to what the pipeline actually needs to read and forward — nothing broader.

Why VPC Flow Logs?

Unlike host-based logging, VPC Flow Logs give visibility into network communication across EC2, ALBs, NAT Gateways, and other supported interfaces — observing cloud networking behavior directly, rather than relying solely on what an individual OS chooses to log.

show inventory

Technologies Used

AWS NetworkingAmazon VPCVPC Flow Logs CloudWatch LogsAmazon EC2AWS IAM Hybrid CloudWazuhOpenSearch SIEM IntegrationDetection EngineeringCloud Security

show detections

What Gets Detected

Instead of forwarding every raw network record into Wazuh, the processing layer normalizes AWS telemetry and emits structured behavioral events — built so new detections can be added later without redesigning the pipeline.

Port Scan Detection

Flags a source touching an unusual spread of destination ports in a short window — classic reconnaissance behavior.

Brute Force Detection

Flags repeated connection attempts against a single service, distinguishing accepted from rejected traffic.

MITRE ATT&CK Alignment

Structured events are generated with MITRE-ready alerting in mind, so findings map to a recognized framework.

example structured event · syntheticmedium

{
  "event_type": "port_scan_detected",
  "source_ip": "203.0.113.42",
  "destination_ports_touched": 14,
  "window_seconds": 60,
  "mitre_technique": "T1595 - Active Scanning",
  "severity": "medium"
}

illustrative event shape — not a captured production alert

Network-layer detections here are designed to complement, not replace, host-level signal — a repeated connection attempt flagged by this pipeline reads very differently next to a corresponding authentication failure from a database audit log. Correlating the two is where the next roadmap phase is headed.

cat business-value.md

Why This, Instead of a Second SIEM

This shows how to extend existing on-prem security operations into AWS without introducing a second enterprise SIEM platform to license, tune, and maintain.

By leaning on AWS-native logging and doing the noise reduction before ingestion, the pipeline improves cloud visibility, keeps log volume sane, and leaves room to grow into more advanced cloud security capability later — without a redesign.

ls Images/

Implementation Walkthrough

Screenshots captured from the live deployment showing telemetry flow from AWS into the on-premises Wazuh SIEM.

EC2 Processing Layer

AWS EC2 instance acting as the log collection and processing server.

CloudWatch VPC Flow Logs

VPC Flow Logs generated by AWS and stored in CloudWatch.

Flow Logs Ingested

Normalized VPC Flow Logs successfully ingested into Wazuh archives.

Wazuh Agents

Hybrid environment with AWS and on-prem agents connected.

Threat Detections

Custom detections including port scans and brute-force attempts.

MariaDB Correlation

Database authentication events correlated with network telemetry.

Threat Hunting Dashboard

Security analytics dashboard showing detections and alert trends.

Vulnerability Detection

Wazuh vulnerability dashboard for the AWS collector instance.

git diff --stat

Current State & What's Next

committed — current state (mvp)
+Production telemetry ingestion via Flow Logs
+Modular behavioral detection framework
+Live Wazuh integration, on-prem
+MITRE-ready alerting
+OpenSearch dashboard visualization
+Port scan & brute force detection

candidate-config — roadmap
~CloudTrail integration
~GuardDuty & Security Hub correlation
~AWS WAF log ingestion
~GeoIP / ASN enrichment
~Threat intelligence feeds
~Lateral movement & exfil analytics
~Terraform + CI/CD

show notes

Lessons Learned

#Designing a hybrid telemetry pipeline end to end

#Reducing signal-to-noise before SIEM ingestion

#Structuring network events for behavioral analysis

#Extending on-prem SOC tooling into the cloud

#Correlating network detections with auth logs

#Counting connection attempts, not just log records

#Least-privilege IAM for telemetry pipelines

#Designing for modular growth, not a rebuild