Cloud Log Preservation

AWS CloudTrail Investigation

Using AWS CloudTrail logs, which record API calls and account activity, to investigate a cloud incident: who did what, from where, and when. It is the primary evidence source for AWS control-plane actions.

Azure Incident Investigation

Investigating a security incident in Microsoft Azure using its logs and signals, such as Entra ID sign-in logs, activity logs, and Microsoft Defender alerts, to determine what an attacker did and how far they reached.

Cloud IR Evidence Sources

The places a cloud responder gathers evidence during an incident, control-plane and audit logs, identity sign-in logs, network flow logs, disk snapshots, memory captures, and provider detection findings. Knowing them is essential to investigate effectively.

Cloud IR Timeline Management

Building and maintaining an accurate chronological record of a cloud incident, ordering events from logs across identity, control plane, and workloads so responders understand what happened, in what sequence, and how far the attacker reached.

Cloud Native vs LiftedStart here

Cloud Native Computing Foundation

Azure VM Forensics

Cloud Forensic Collection

Cloud IR Fundamentals

Cloud IR Playbook Design