How to Preserve Cloud Audit Logs During a Security Investigation

Cloud audit data may expire or be changed if retention and access are not protected during an investigation.

Checks to make

Identify relevant accounts, regions, services, and time windows; preserve logs to a controlled destination; restrict modification; and record collection time and method. Check identity, control-plane, and data access events for coverage gaps.

When to get help

Incident response can preserve cloud evidence and identify logging gaps. Informatix Systems can assess the symptoms, evidence, and next steps. Contact Informatix Systems to discuss this issue.