The power of orchestration: how we automated enrichments for AWS alerts

This blog post explains how Expel automates AWS IAM alert enrichments to accelerate and standardize triage. It details methods for linking assumed roles to their assumer, detecting role-assumption types (SAML, console, service, CLI/SDK), enumerating services an identity has interacted with, flagging modifying or failed API calls, and comparing recent activity to a historical baseline using CloudTrail and GuardDuty data to give analysts contextualized, actionable insights.