Security Operations & Incident Response

Large or unusual downloads may indicate legitimate work, misconfigured automation, or unauthorized data access. Checks to make Review identity, device, file scope, time, sharing context, and related sign-ins. Compare with approved business activity and preserve audit records. Apply containment according to policy if evidence supports exposure, and...

A suspicious sign-in requires containment, but broad account shutdown can interrupt critical work before evidence is understood. Checks to make Validate sign-in context, factor changes, sessions, and recent account actions. Use targeted session revocation or credential reset under policy, confirm the user through a trusted channel, and preserve audit...

Unexpected identity policy changes can broaden access or block normal users and may originate from automation or compromised credentials. Checks to make Review audit events, actor identity, change diff, approval record, and related sign-ins. Confirm with the change owner through a trusted channel, preserve policy versions, and contain unauthorized...

A new administrator account may be a legitimate change, automation artifact, or sign of unauthorized access. Checks to make Preserve the account event and actor details, check approval and change records, review sign-ins and actions performed, and confirm with the system owner through a trusted channel. Disable or contain access according to response...

A DNS change can redirect users, disrupt services, or be part of a legitimate migration or a security event. Checks to make Preserve provider audit logs, identify the actor and account session, compare changes with approved records, and verify current authoritative answers. Restore trusted values through a controlled process and review registrar and...

An external forwarding rule can persistently copy messages beyond the organization without obvious mailbox activity. Checks to make Preserve the rule and audit history, identify who created it and when, review sign-ins and mailbox actions, and assess data exposure. Remove or disable it under response procedures, revoke suspicious sessions, and check...

A traffic spike may come from a backup, update, data transfer, misconfiguration, or unauthorized activity. Checks to make Identify source hosts, destination categories, protocol, and timing; correlate with scheduled jobs and change records; and inspect endpoint and network logs. Preserve flow data and assess data sensitivity before blocking traffic...

A deleted resource may be caused by an approved deployment, lifecycle policy, mistaken action, or compromised account. Checks to make Preserve audit events, identify actor, API action, and affected dependencies, and compare with change records and infrastructure state. Assess recovery point and business impact, restore through the approved process, and...