Compliance Engineering Platform

Cloud Security Baseline Automation

Live

Continuous monitoring

GuardDuty Security Hub AWS Config

Point-in-time security reviews are a liability. A quarterly scan tells you what your environment looked like on one day, four times a year. Everything that changed between those days is invisible until the next review or until something breaks.

This baseline replaces that model with continuous monitoring. GuardDuty, AWS Config, and Security Hub run constantly. Every configuration drift event is detected, enriched with resource context, and routed automatically. The security posture of the environment is visible in real time, not at the next scheduled review.

Under 2hr

Mean time to detect configuration drift

45 min

Manual triage per incident eliminated

24/7

Continuous coverage replacing quarterly reviews

Try it. Inject a finding.

Select a security event and watch it flow through the detection, enrichment, and routing pipeline in real time.

GuardDuty detecting event...

FINDING DETECTED

Live event feed Monitoring active

How it works

01

GuardDuty monitors all API activity

GuardDuty analyzes CloudTrail logs, VPC Flow Logs, and DNS logs continuously. It detects anomalies like reconnaissance activity, credential abuse, and unusual API call patterns without any manual tuning.
02

AWS Config tracks every configuration change

Config records the state of every AWS resource continuously. When a resource drifts from its approved baseline, a Config rule fires within minutes and sends the change to Security Hub.
03

EventBridge routes findings to Lambda for enrichment

Every Security Hub finding triggers an EventBridge rule. The rule invokes a Lambda that enriches the finding: who owns this resource, what environment is it in, what is the blast radius. The enriched finding routes to the right team automatically.
04

CloudTrail provides the complete audit trail

Every API call, every configuration change, every access event is logged to CloudTrail and protected in S3 Object Lock. The complete history of every action taken in the environment is tamper-evident and available for forensic reconstruction.

Stack

GuardDuty AWS Config Security Hub CloudTrail EventBridge Lambda S3 Object Lock SNS

Part of the Compliance Engineering Platform, built from the CloudTrail, Config, and Security Hub baseline developed across 11 labs in the GRC Engineering program.

Changelog

Jul 6, 2026 Interactive demo launched. Three finding scenarios live: recon activity, config drift, credential abuse.

Jul 6, 2026 EventBridge enrichment Lambda extended to include resource owner lookup from tagging API.

Jul 5, 2026 Security Hub custom action added for one-click escalation to incident response workflow.

Jul 3, 2026 CloudWatch alarms added for Lambda error rate and Security Hub finding volume anomalies.

↗ GitHub repo ← Back to platform ← All projects