Cloud security detections
CloudShield
Audit events into explainable cloud detections.
The system
CloudShield evaluates GCP IAM and Kubernetes audit events against documented detection rules. Its public repository includes the rules, test corpus, and evaluation code. Review the implementation.