My internship mentor asked me to look into detecting lateral movement in our AWS network using open source tools where should I start
Download run
Fan-out diagram
The searches the AI actually ran for this prompt.
SEED QUERY
My internship mentor asked me to look into detecting lateral movement in our AWS network using open source tools where should I start
3 real searches · 1 real-search pass
Badge and edge weight = share of passes that produced the query. Hover a query for its intent and routing format.
Query classes
Google's semantic query class for every sub-query: what kind of answer each search is after, simulated vs real.
Classifying 3 queries…
Searches and sources
ChatGPT3 real searches · gpt-6
open source AWS lateral movement detection Zeek Suricata Wazuh Falco osquery official documentation Google ↗
Zeek network security monitor documentation AWS VPC traffic mirroring Google ↗
Wazuh AWS CloudTrail integration documentation Google ↗
- Zeek documentation · docs.zeek.org
- Suricata documentation · docs.suricata.io
- Wazuh documentation · documentation.wazuh.com
- osquery website · osquery.io
- Falco documentation · falco.org
- VPC Flow Logs · docs.aws.amazon.com
- Work with open-source tools for traffic mirroring · docs.aws.amazon.com
- Monitoring your VPC · docs.aws.amazon.com
- What Is Zeek? · docs.zeek.org
- MITRE ATT&CK framework · attack.mitre.org
Queries
3 queries · click a column to sort
| Query / type | Search | Intent | Query class | Routing format | Cluster | Freq ↓ | Weight |
|---|---|---|---|---|---|---|---|
open source AWS lateral movement detection Zeek Suricata Wazuh Falco osquery official documentation OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 | |
Zeek network security monitor documentation AWS VPC traffic mirroring OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 | |
Wazuh AWS CloudTrail integration documentation OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 |