orca-investigate

Trace actor activity from CloudTrail logs to build session timelines, map actions to MITRE ATT&CK techniques, and assess blast radius across accounts. This produces a risk verdict with cross-account context and actionable containment recommendations.

Blast radius assessment in cloud forensics maps how far an attacker went across one or more cloud accounts. It correlates related audit log events to identify cross-account activity and measure the full scope of a security incident.

Map suspicious cloud activity to MITRE ATT&CK techniques by analyzing actor sessions built from cloud audit logs. The investigation correlates observed actions to specific MITRE ATT&CK for Cloud techniques, providing a clear narrative of event sequences.

Yes, you can trace cross-account activity during a cloud security investigation. The analysis correlates related events from CloudTrail and audit logs across multiple cloud accounts to identify lateral movement and provide a comprehensive blast radius assessment.

Yes, you need Orca CDR integration to collect events and run a forensic investigation on cloud audit logs. The integration gathers CloudTrail and audit log data to build sessions, map MITRE ATT&CK techniques, and produce a risk verdict.

The best way to build a session timeline for a cloud security incident is to run an investigation on an actor or account. This generates a prioritized timeline from audit logs that answers what happened, who did it, and how far they went.