--- title: Cloud Detection at Scale on a Laptop | daily.dev description: RSigma v0.11.0 is benchmarked against 1.9 million real AWS CloudTrail events from the flaws.cloud public dataset on an Apple Silicon laptop. The tool processes... canonical: https://daily.dev/posts/cloud-detection-at-scale-on-a-laptop-vlgt1lhyx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Cloud Detection at Scale on a Laptop | daily.dev og:description: RSigma v0.11.0 is benchmarked against 1.9 million real AWS CloudTrail events from the flaws.cloud public dataset on an Apple Silicon laptop. The tool processes... og:url: https://daily.dev/posts/cloud-detection-at-scale-on-a-laptop-vlgt1lhyx og:image: https://api.daily.dev/og/posts/vLgt1lhyX.png og:image:alt: Cloud Detection at Scale on a Laptop og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Cloud Detection at Scale on a Laptop **[ITNEXT](https://daily.dev/sources/itnext)** · 17 min read · 0 upvotes · 0 comments ## Summary RSigma v0.11.0 is benchmarked against 1.9 million real AWS CloudTrail events from the flaws.cloud public dataset on an Apple Silicon laptop. The tool processes the entire 3.5-year corpus in 16.76 seconds at ~115k events/second using 55 SigmaHQ rules, yielding 68,576 matches. The post covers translating an AWS incident response playbook (easttimor/aws-incident-response) from Athena SQL to portable Sigma rules, setting up a Vector-to-RSigma streaming pipeline, and benchmarking the optional bloom prefilter and cross-rule Aho-Corasick index layers — which help only at 1,000+ rules and actually slow things down at 55 rules. Key findings include detection of IMDS credential abuse matching the Capital One breach pattern, noisy STS AssumeRole detections, and root credential use. The article also discusses CloudTrail's inherent logging gaps and how ATT&CK tagging enables tactic-level coverage analysis via Grafana dashboards. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [The State of RSigma](https://daily.dev/posts/the-state-of-rsigma-wf2clyaau) · ITNEXT · 21 upvotes · 1 comments - [Streaming Logs to RSigma for Real-Time Detection](https://daily.dev/posts/streaming-logs-to-rsigma-for-real-time-detection-sy1o5zzoa) · ITNEXT · 0 upvotes · 0 comments - [Building a Detection Layer on PostgreSQL with Sigma Rules](https://daily.dev/posts/building-a-detection-layer-on-postgresql-with-sigma-rules-g9rkyvinz) · ITNEXT · 0 upvotes · 0 comments - [The State of RSigma, Part Two: The Loop](https://daily.dev/posts/the-state-of-rsigma-part-two-the-loop-nvah6gchz) · ITNEXT · 0 upvotes · 0 comments - [Pattern Detection and Correlation in JSON Logs](https://daily.dev/posts/pattern-detection-and-correlation-in-json-logs-ugyeslu5i) · ITNEXT · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#aws](https://daily.dev/tags/aws) [View this post on daily.dev](https://daily.dev/posts/cloud-detection-at-scale-on-a-laptop-vlgt1lhyx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Cloud Detection at Scale on a Laptop","url":"https://daily.dev/posts/cloud-detection-at-scale-on-a-laptop-vlgt1lhyx","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cloud-detection-at-scale-on-a-laptop-vlgt1lhyx"},"datePublished":"2026-07-08T20:33:47.662Z","dateModified":"2026-07-08T20:34:14.250Z","description":"RSigma v0.11.0 is benchmarked against 1.9 million real AWS CloudTrail events from the flaws.cloud public dataset on an Apple Silicon laptop. The tool processes...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ee0ff356d00d584e3824e993fd0c1594?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ee0ff356d00d584e3824e993fd0c1594?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"ITNEXT","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ITNEXT","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/itnext2","url":"https://daily.dev/sources/itnext"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cloud-detection-at-scale-on-a-laptop-vlgt1lhyx","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,aws","timeRequired":"PT17M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ITNEXT","item":"https://daily.dev/sources/itnext"},{"@type":"ListItem","position":3,"name":"Cloud Detection at Scale on a Laptop"}]} ```