Lightning cracked over the data center, and the logs kept coming. AWS CloudTrail events streamed in without pause. Without the right queries and runbooks, they were noise. With them, they were power.
RASP CloudTrail Query Runbooks turn that noise into action. By combining Runtime Application Self-Protection (RASP) data with AWS CloudTrail queries, you can detect, investigate, and respond to threats in minutes. This is not guesswork. It is a repeatable process you can run on demand.
Start with the base: CloudTrail captures every API call in AWS. RASP adds runtime protection from within your code. Together, they give you both perimeter and in-app telemetry. A runbook defines the exact queries, filters, and actions that turn that telemetry into answers.
A strong RASP CloudTrail query runbook includes:
- Event filters for sensitive actions like
DeleteTrail, PutBucketPolicy, and AssumeRole - Correlation between RASP alerts and CloudTrail event IDs
- Query parameters that isolate suspicious IP ranges or device fingerprints
- Commands to pivot into related Lambda logs, S3 access logs, or runtime traces
- Automated remediations triggered by query results
For example, a runbook might begin by querying CloudTrail for new IAM users created outside of approved pipelines. It then checks those events against RASP intrusion alerts from the same time frame. If matched, the runbook escalates and blocks affected tokens. Every step is documented, tested, and ready to rerun.
When writing these runbooks, keep your CloudTrail queries explicit. Timestamp ranges should be exact. Filters should target only what matters. Link results back to your RASP telemetry for full context. Avoid vague searches—precision cuts noise and shortens time to resolution.
Store your RASP CloudTrail query runbooks in source control. Version them. Update them when AWS releases new event types or when your RASP agent adds capabilities. Run them after every incident and during scheduled threat hunts.
The payoff is speed. Instead of sifting thousands of JSON entries, you run a script. Instead of forgetting what worked last time, you follow a proven path. Instead of losing hours, you finish in minutes.
See how fast this can be. Build and run your first RASP CloudTrail query runbook on hoop.dev and watch it go live in minutes.