AWS SOAR Engine

AWS tutorials only alert via email on incidents; email gets ignored. Wanted the fastest way to notify a human the moment an attack happens.

DVWA on Docker behind AWS WAF/ALB; on Layer-7 attack detection, a Lambda function parses S3 threat logs, moves the EC2 instance into a zero-ingress quarantine security group, and places a Twilio voice call stating the attack, attacker IP, and remediation taken. Chose a phone call over Slack/SMS deliberately, since it is harder to ignore. Real failure modes hit and fixed: calls not firing or arriving late (fixed by testing one attack at a time, waiting to confirm before the next, sometimes using a second IP to disambiguate), WAF silently blocking most attacks without logging (worked around by only testing attack types WAF actually logged), and manual security-group reset needed after each quarantine.

Working proof of concept, documented with a GitHub repo and video demo, presented at a fellowship session where the instructor called it a genuinely novel approach. Torn down afterward to avoid ongoing AWS cost, since it was built to prove the concept, not run in production.