Instance Enumeration — Detection Telemetry

Collection and providers

Include supported read management APIs and retain caller, scope, query/filter and result; read auditing differs between providers.

• AWS CloudTrail: Management-plane API activity; supported resource/data events require separate selectors.
• Azure Monitor Activity Log: Azure resource control-plane operations; resource data-plane logs are separate.
• Google Cloud Audit Logs: Admin Activity and other categories; configure Data Access where required.

Configuration

• In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.
• Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.
• Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies.

Synthetic event example

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0075",
  "collector": "illustrative-lab-collector",
  "observation": {
    "action": "list_instances",
    "region": "lab-region",
    "actor": "lab-reader",
    "result": "success"
  }
}

Visibility and validation

AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.

• Record the lab scope, collector version, effective configuration and expected source fields before testing.
• Use an approved benign action or read-only snapshot appropriate to this type. For destructive, privileged or physical effects, use a reviewed fixture or existing authorized evidence instead of causing the effect.
• Verify the native source record locally and at the collector; compare timestamps, identity, object, action/result and the type-specific fields listed below. Save a redacted real capture separately from the synthetic example.
• Check a normal baseline and collector-loss case. Fixture parsing proves parser behavior only; it does not prove sensor coverage or malicious-behavior detection.

Primary sources

• AWS CloudTrail event categories
• AWS EC2 API logging with CloudTrail
• Azure Monitor Activity Log
• Google Cloud Audit Logs