☁️
Cloud & Identity Compromise
Unauthorized access to cloud infrastructure or identity provider through stolen tokens, OAuth abuse, or misconfigured access policies.
25 runbook nodes8 lifecycle stages covered
Triage
(3 nodes)Containment
(2 nodes)Preservation
(4 nodes)Collection
(5 nodes)EDR Telemetry Collection
P2EDR Collection
120min
View node
M365 Unified Audit Log Collection
P2M365 UAL Collection
90min
View node
Azure AD Sign-In and Audit Log Collection
P2Azure AD Logs
60min
View node
Identify Alternative Evidence When Primary Logs Are Missing
P2Missing Log Fallback
60min
View node
Coordinate Log Collection from Third-Party Vendors
P3Third-Party Logs
120min
View node