Cloud and identity threat response
Detections from AWS, Azure and Google Cloud and from the identity provider are investigated and contained with the same playbooks, so a stolen key or a hijacked session is handled the same way in every cloud.
The problem
Cloud attacks move through identities: a leaked access key, a consent grant, an impossible-travel sign-in, a role assumed from an unusual place. Each cloud logs these events differently, and teams usually have strong playbooks for one cloud and nothing for the others.
Stack
- Clouds
- AWS CloudTrailAWS GuardDutyAzure Activity LogsDefender for CloudGoogle Cloud audit logs
- Identity
- Entra IDOkta
- SIEM
- SplunkIBM QRadarMicrosoft Sentinel
- Orchestration
- Cortex XSOARCortex XSIAMAzure Logic AppsPython
How it works
- 1
Collect
CloudTrail and GuardDuty for AWS, Azure Activity Logs, Entra ID sign-in logs and Defender for Cloud for Azure, and audit logs for Google Cloud reach the SIEM, normalized to one schema.
- 2
Detect
Rules cover the identity patterns that matter: impossible travel, new MFA methods, privilege escalation, access keys used from new locations, service accounts acting outside their usual pattern.
- 3
Investigate
The playbook gathers what the identity did in the last hours across clouds: sign-ins, API calls, resources touched, and whether the behavior matches its baseline.
- 4
Contain
Depending on severity and approval, it revokes sessions, disables the user or the access key, removes risky role assignments and applies a restrictive policy to the resource.
- 5
Recover
It tracks the follow-up: rotate secrets, review what was accessed, restore access, and write the case summary.
Guardrails and failure handling
- Break-glass accounts are excluded from automatic containment.
- Containing a service account needs its owner's approval, because it can stop a production workload.
- Automation runs under least-privilege roles, one per cloud.
- Every action is logged with its input, its approver and its result.
What changes for the SOC
- The same playbook logic applies in all three clouds.
- Containing an identity compromise no longer means hunting through consoles.
- Production workloads are protected by the approval on service accounts.