Cloud Threat Detection Capabilities with The DeRF: Bridging the Gap in Current Tools by Kat Traxler

The blog announces DeRF (Detection Replay Framework), an open-source Terraform and Cloud Run–based framework for deploying and executing simulated AWS/GCP attack techniques to validate detections and controls; it describes design decisions (permission separation, YAML-extensible techniques), built-in modules, deployment and execution workflows, personas, cost and runtime characteristics, and planned future enhancements.