Cloud and identity alerts playbook

1. 1. Identify who or what actedA person, a service account, or an address? Look at the device, location and time.
2. 2. Is it normal for them?Compare with their usual place, device and working hours. Remember a VPN can make a user appear to be in another country.
3. 3. How did they authenticate?Was MFA asked for and passed? A flood of prompts, or old protocols such as IMAP that skip MFA, are warning signs.
4. 4. See what happened nextNew MFA devices, inbox rules that forward or hide mail, large downloads, new permissions. Attackers do these to stay in.
5. 5. Look for an explanationAn approved change, a VPN log, a ticket. Always check before assuming the worst.
6. 6. ContainRevoke sessions, reset the password and MFA methods, remove new rules, and undo risky changes such as a public storage bucket.

Tools you will use

Practice with this playbook

• SL-1009Impossible travel activitymedium
• SL-1010Multiple MFA denials followed by approvalhigh
• SL-1011Storage bucket ACL changed: public access enabledhigh
• SL-1014Sign-in from unfamiliar IP addressmedium
• SL-1015Service account: new source IP and bulk data exporthigh
• SL-1021Concurrent admin session from multiple IPscritical
• SL-1024New MFA method registered after admin resethigh
• SL-1028Cloud access key used from new IP and new regionhigh
• SL-1029OAuth app consent: new app granted mail accesshigh
• SL-1035Cloud AI usage above baselinemedium
• SL-1043Sign-in without MFA from service account (SMTP AUTH)medium