Security Operations & Incident Response

An external forwarding rule can persistently copy messages beyond the organization without obvious mailbox activity. Checks to make Preserve the rule and audit history, identify who created it and when, review sign-ins and mailbox actions, and assess data exposure. Remove or disable it under response procedures, revoke suspicious sessions, and check...

An unexpected MFA method change may reflect legitimate device replacement or an attacker weakening account protection. Checks to make Preserve identity audit events, verify the user through a trusted channel, review recent sign-ins and recovery changes, and confirm the new factor owner. Revoke suspicious sessions and restore approved factors under the...

A traffic spike may come from a backup, update, data transfer, misconfiguration, or unauthorized activity. Checks to make Identify source hosts, destination categories, protocol, and timing; correlate with scheduled jobs and change records; and inspect endpoint and network logs. Preserve flow data and assess data sensitivity before blocking traffic...

A deleted resource may be caused by an approved deployment, lifecycle policy, mistaken action, or compromised account. Checks to make Preserve audit events, identify actor, API action, and affected dependencies, and compare with change records and infrastructure state. Assess recovery point and business impact, restore through the approved process, and...

An API call spike can come from new automation, retries, a deployment loop, or unauthorized use of a credential. Checks to make Segment audit events by identity, action, resource, and time, then compare with deployment and job schedules. Check for unusual regions or permissions, preserve logs, and contain credentials through the response process if...

Shared service identities make it harder to attribute actions and distinguish automation from unauthorized use. Checks to make Identify the service owner and expected schedule, compare API or process activity with deployment records, and review credential usage and source hosts. Preserve logs and rotate or constrain credentials if activity cannot be...

A policy may be disabled by an approved change, misconfiguration, agent failure, or unauthorized administrative action. Checks to make Check policy audit history, actor and approval, affected device scope, agent status, and related identity events. Restore protection using controlled change procedures and monitor for repeated policy changes. When to...

Authentication failures may indicate expired credentials, a deployment error, abuse, or an attempted credential attack. Checks to make Group failures by key or identity, source, endpoint, and time; compare with credential rotations and deployment records; and look for successful use after the failures. Preserve logs and rotate or restrict credentials...