How Expel goes detection sprinting in Google Cloud

Expel outlines a two-week Google Cloud Platform detection sprint that targets service account impersonation—particularly attacks that deploy multiple cloud functions to capture credentials—by leveraging Admin Activity audit logs and implementing a detection in their Josie engine that flags bursts of unique cloud function deployments within a short window; the post describes their iterative process (ideate, evaluate, create, appreciate), testing and tuning with Datadog, and preparing detections for production with triage guidance and monitoring.