running-cloud-ir-runbook

Cloud incident response for GuardDuty alerts requires coordinated triage, evidence preservation, and containment. You must capture evidence before containment, analyze the blast radius, eradicate follow-on access paths, and document recovery controls with assigned owners.

Containing leaked credentials starts with preserving evidence before disabling the compromised identity. Next, execute provider-specific containment commands, analyze the blast radius for cross-account access, eradicate follow-on paths, and apply recovery controls to secure the environment.

Yes, evidence preservation before containment is required for public storage exposure. Capturing logs and forensic snapshots first ensures the blast radius can be analyzed accurately, enabling proper eradication of follow-on access paths and recovery.

Documenting lessons learned after a cloud security incident involves generating factual communications for regulators and internal teams. The output must include recovery controls, follow-on access path eradication steps, and assigned owners with deadlines for remediation tasks.

Yes, a single runbook can coordinate suspicious cross-account access response across AWS, GCP, and Azure. It applies provider-specific containment commands and blast-radius analysis to ensure consistent triage, evidence preservation, and recovery.

Triage compromised service identities in Defender for Cloud by capturing evidence, executing containment commands, and analyzing the blast radius. You must also eradicate follow-on access paths and document lessons learned with owners and deadlines.