Automated AWS threat detection and response

The scenario

ThreatTrail wires CloudTrail and GuardDuty findings into a Lambda that enriches each finding, asks an LLM to explain it in plain language, notifies the team, and — for well-understood cases like exposed access keys — takes a containment action automatically.

System architecture

High-level flow of ThreatTrail, from input to output.

What you will learn

• AWS security services
• Event-driven response automation
• LLM explanations for alerts

What you will build

• Finding pipeline
• Explainer Lambda
• Auto-containment playbooks

Build plan

1. Enable detection
2. Route findings
3. Explain with LLM
4. Playbooks
5. Test with simulations

Tech stack