Security Operations & Incident Response

Missing logs can leave gaps in the timeline and increase uncertainty about what happened. Checks to make Record which sources and periods are unavailable, preserve remaining evidence, compare independent telemetry, and check retention or forwarding failures. State conclusions with confidence limits and restore logging before closing the incident. When...

Cloud audit data may expire or be changed if retention and access are not protected during an investigation. Checks to make Identify relevant accounts, regions, services, and time windows; preserve logs to a controlled destination; restrict modification; and record collection time and method. Check identity, control-plane, and data access events for...

A shared credential can be copied or used before the exposure is noticed, even if it is later removed from a message. Checks to make Revoke or rotate the credential through the provider, review recent admin activity and active sessions, and identify where else the secret may have been stored. Preserve audit evidence, notify the accountable owner, and...

Large or unusual downloads may indicate legitimate work, misconfigured automation, or unauthorized data access. Checks to make Review identity, device, file scope, time, sharing context, and related sign-ins. Compare with approved business activity and preserve audit records. Apply containment according to policy if evidence supports exposure, and...

A suspicious sign-in requires containment, but broad account shutdown can interrupt critical work before evidence is understood. Checks to make Validate sign-in context, factor changes, sessions, and recent account actions. Use targeted session revocation or credential reset under policy, confirm the user through a trusted channel, and preserve audit...

Unexpected identity policy changes can broaden access or block normal users and may originate from automation or compromised credentials. Checks to make Review audit events, actor identity, change diff, approval record, and related sign-ins. Confirm with the change owner through a trusted channel, preserve policy versions, and contain unauthorized...

A new administrator account may be a legitimate change, automation artifact, or sign of unauthorized access. Checks to make Preserve the account event and actor details, check approval and change records, review sign-ins and actions performed, and confirm with the system owner through a trusted channel. Disable or contain access according to response...

A DNS change can redirect users, disrupt services, or be part of a legitimate migration or a security event. Checks to make Preserve provider audit logs, identify the actor and account session, compare changes with approved records, and verify current authoritative answers. Restore trusted values through a controlled process and review registrar and...