Cloud Environment Discovery

Maps cloud infrastructure to a security graph with MITRE ATT&CK and ATLAS technique overlays. Each resource becomes a graph node, each relationship an edge. Attack techniques are mapped as edges from technique nodes to vulnerable resources. When an OCSF consumer needs inventory-shaped output, the same snapshot can be emitted as Cloud Resources Inventory Info [5023].

When to Use

• Map cloud attack surface before a security assessment
• Visualize IAM → service → storage → network relationships
• Overlay MITRE ATT&CK techniques on infrastructure for threat modeling
• Export cloud inventory as graph JSON for any visualization tool
• Emit an OCSF Discovery bridge event for inventory-oriented pipelines
• Feed into agent-bom's unified graph for cross-platform posture view
• Periodic environment drift detection (compare graph snapshots)

Architecture