The Normalyze query builder is built for this purpose so you can easily create your own “signatures” from specific attack paths in your cloud environment. You can use the query builder interface to create and test this attack path. You can then promote it to the library of signatures that are run each time the graph changes.