RoleFlux: building an open-source GCP CDR platform for real SOC workflows
A full overview of RoleFlux, a serverless GCP cloud detection and response platform that turns audit logs into actionable security signals with MITRE mapping and AI triage.
RoleFlux started as a simple idea: make cloud security detection less noisy, more deterministic, and easier to trust. Instead of shipping a flashy AI assistant that guessed at incidents, the project focuses on a strong detection engine first and AI second. That creates a better product for defenders because the system can explain what happened, why it mattered, and what to do next.
The platform intercepts real GCP Audit Logs, evaluates the relevant IAM and admin events through a deterministic Python decision engine, scores the risk, maps it to MITRE ATT&CK, and then passes the incident context to Gemini for human-readable triage and recommended remediation commands. The result is a workflow that feels closer to a real SOC operation than a generic LLM demo.
Why this project matters
Cloud environments are noisy. There is no shortage of alerts, but operational signal is scarce. Many security platforms flood teams with telemetry and vendor language without giving them a clear path to answer three questions: what happened, is it serious, and what should an engineer do now? RoleFlux tries to solve that with a cleaner workflow and a stronger trust boundary.
| Layer | What it does | Why it matters |
|---|---|---|
| Audit Log Ingestion | Captures Admin Activity and IAM changes | Finds events that matter before they become incidents |
| Deterministic Engine | Scoring and rule evaluation | Keeps logic explainable and avoids LLM hallucinations |
| AI Triage | Summaries and remediation guidance | Speeds up analyst response without removing the signal |
| BigQuery Dashboard | Visualization and investigation | Creates a usable command center for operations |
Project architecture
The architecture is intentionally straightforward. GCP Audit Logs feed into a log sink, which pushes events into Pub/Sub. Cloud Functions process the event stream, score the risk, and query Vertex AI only when needed. The incident data is stored in BigQuery, where the dashboard and investigation tooling can surface patterns over time.
Detection engine first, AI second
The most important design choice in RoleFlux is that the AI layer does not make the first decision. The detection engine does. That means the platform can reason in a deterministic way before using AI for narrative generation or remediation guidance. This is an important improvement over setups where LLMs become an opaque final adjudicator for real security decisions.
- Evaluate high-risk IAM activity such as SetIamPolicy changes
- Assign a numeric risk score from 0 to 100
- Map suspicious behavior to MITRE ATT&CK tactics
- Generate contextual incident enrichment using Vertex AI
- Provide exact gcloud remediation commands for the human responder
Operational workflow
gcloud logging sinks create roleflux-sink storage.googleapis.com/ROLEFLUX_BUCKET --log-filter='protoPayload.serviceName=iam.googleapis.com OR protoPayload.methodName=SetIamPolicy'
# Then route into Pub/Sub and trigger the detection functionThis gives the team a practical build path: event capture, log normalization, scoring logic, incident storage, dashboard visualization, and human-readable response generation. It avoids unnecessary complexity while staying close to a real production CDR workflow.
Why open source matters here
Cloud security architecture is often treated as proprietary and expensive, but the underlying logic is not magic. It is a combination of event sources, signal detection, triage workflows, and reliable operational patterns. By making RoleFlux open source, the project aims to provide a real reference implementation that defenders can study, adapt, and extend.
“The goal is not to create a black box. The goal is to build a security system that defenders can inspect, trust, and extend.”
The future direction
I want RoleFlux to evolve from a strong open-source starter into a broader cloud defense framework. That includes deeper detection coverage, more cloud providers, richer investigation flows, more insight into lateral movement, and stronger controls around governance. The project is already useful for experimentation, but the long-term goal is to keep it practical for real defenders.
A strong security project is not defined by complexity alone. It is defined by whether it helps people make better decisions under real conditions. RoleFlux is built around that idea, and I am excited to keep expanding it with the community.
