01
Research edition
The original postgraduate research has a public archival record on Zenodo.
Research · Book · Reference implementation
AWS Cloud
Security Automation
A practical investigation into turning AWS security events into explainable monitoring, threat detection, and incident-response workflows.
View the companion repositoryThe project
Security signals are useful only when engineers can trace what happened and why the system responded.
The work began as a postgraduate project on intelligent cloud-security monitoring for AWS. It is now being developed into a public research edition, a forthcoming book, and a tested companion implementation.
The implementation separates ingestion, normalization, correlation, storage, alerting, response, and presentation so each decision can be inspected and tested.
Event path
- 01AWS events
CloudTrail activity and GuardDuty findings enter through Amazon EventBridge.
- 02Normalization
Source events are transformed into a common, versioned security-event schema.
- 03Correlation
Explainable rules connect related activity and assign threat scores.
- 04Response
Later phases add storage, alerting, investigation views, and deliberately constrained response.
Public records
02
Author record
The ORCID record will connect the research, software, and later publications.
03
Source code
The companion repository is the technical source of truth for implemented and tested behavior.
Follow the work.
The research record is available now; later publication links will be added after verification.