P0LR Espresso - Pulling Shots of Cloud Live Response & Advanced Analysis
Art Ukshini
BSides NYC 2025 (0x05) · Day 1 · Tech - Blue
In the rapidly evolving landscape of cloud security, defenders face a formidable challenge: the sheer diversity and fragmentation of logs across multiple cloud providers. Art Ukshini's talk, "P0LR Espresso - Pulling Shots of Cloud Live Response & Advanced Analysis," addresses this critical pain point head-on. The presentation introduces **Polar Espresso**, an open-source Python framework designed to normalize disparate cloud logs, offering a unified view for enhanced threat hunting, incident response, and detection engineering.
AI review
A competent BSides-level talk solving a real, felt pain point — multi-cloud log normalization — with a working open-source tool and a live demo. The problem framing is honest and the tooling is practical, but the contribution is incremental: normalization schemas aren't new, and the execution doesn't push far enough past what OCSF, Sigma, or existing SIEM normalization layers already attempt.